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i en OD ICT TON 


fais thesis addresses DR deeien and Pola 
implementation o? a memory manager for 4a member of the 
family mu Secure, distribute; Mo Emi croprocessor 
operating systems designed by Richardson and O’Connell [1). 
The merory manager is responsible for the secure raragerent 
of the mair memory and seconcary storage. The memory meneger 
design was pune e nes and sconimetedo witr distributed 
Messi, multi-processineg. configuration  indepencence, 
ease of change, and internal computer security as primary 
ans TS proclems feced jn tne design were: 
1) Developine a process which woul? securely manaee 
eee neem M-pDrocessor Environment. 
2) Ensuring tnat if secondary storage was inadvertantly 


u q 6 nn con O usually ve recreatec. 


CA 
Ar 


Minimizing secondary storage accesses. 

4) Proper parameter passing during intervrocess 
Sommunicat Leni. 

5) Tevelcpineg a process with a loop-free structure 


which is configuration independent. 


O) 
e 


Designing datatases which optimize tne memory 
manazement functions. 
The proper design and implementation of a merory 


management process is vital because it serves as the 





e 


interface tetween the physical storage of files in a storage 


in 


Ewemeeand the logical hierarchical file structure as viewed 
by the user (viz., the file system supervisor desien by 
Parks f[2]\. If the memory maneger process Goes not furctiorn 
properly, the security of that system cannot be guaranteed. 
The secure family of operating systems designed tr 
Richardson and O°Connell is composed of two primary mcdules, 
NS De visor end tne security, rernel. A subset of thet 
system was utilized in the design of tne Secure Archival 
Storage System (SASS). The design of the SASS supervisor was 
addressed hy Parks [2], while the security kernel was 
addressed concurrently by Coleman [3]. The SASS security 


v 


kernel design is composed of two parts, the distributed 
Mere and the non-distributed kernel. The design of the 
distrituted kernel was conducted by Colerar [3], and 
processor management was implemented ty Reitz [4]. This 


thesis presents “tre design and implemertaticn cf tre 


wn distributed Kernel. In the SASS Ges ver, the 
men—-distributed kernel consists solely of the memory 
ranaser. 


The design of the memory manager and its data beses was 


Eumpleted. The initial code was written in FLZ/SYS, tut 


HU 
n 


moma not te compilec due to the lack of a FIZ/SYS compiler. 
A thread of the high level code was selected, hand compiled 


into PIZ/ASM, and run on the Z82£0 developmental mocule. 


TE 





The PIM/ASM trread listing is resented as a corputer 


euostem appended to this thesis. 


ERR BACKGROUND 


Shera tie Systems were itttally developed durine an era 
when hardware was a scarce and expensive resource, while 
software was relatively inexpensive. The initial syster 
cesien Lecan ane wes to begin with the hardware 
Hou i2suration and to build the operating system upen it. The 
“bottom vp design technique was practical, but it made tre 


operating system extremely hardware dependent. tardware 


(D 


Es corat?ion changes would often force a major softwar 
meaesien, but as lore as hardware costs were dominant, 
Softwere modification was the logical alternative. As tke 
functions required of the operating system increased, new 
mmerecaures were haéyrezardiy added to the operétirg syster, 
Ben introcucing new problems. Mainterarce anrd debugging cf 
the operating system became extremely cumbersore and tire 
consuming. 


The increased usage of computers in such fislis as 


ED» 


Mmemence ard sensitive information handling uncovered a 


fu 


Serious problem with most operating Sens. Lumormetrion 


in 
ed 


no red Brain a computer system was generally quite 
accessibie to anyone who had a working knowledge of 


operating system design and structure, regarcless cf any 





ad-hoc atterpts to provide interral computer security. Data 
Miored in information cystems, with security edded in, covld 
not be certified as beine totally secure[1<)!. 


Fecent technological developments have reversed tre 


economics of ine computer design environment. 
mer Oprocessors have become erumdent, Dower Ul and 
inexpensive. The relative cost of software, or the 


meperhend, has Steadily increased until it now domiretes the 
overall cost of a computer system. This reversal has two 
Berge implications. First, software must be treated as the 
expensive commodity. Software developed snould trerefore be 


A 


logical, easy to read. relatively maintenance free, and eas 


ct 


to debug. Second, more powerful hardware can te used 0 
Nor” functions previously performed with software, ani 
thus hardware (multiprocessors) can te utilized to achieve 
overall system speed eoals. 

The SıSS was developed utilizing à Lon dowr design 
Bueunique, with informatior security as a primary Gesien 
issue. Security was designed into the system tased upon tne 
Security kernel corcept [5]. The security kernel prevides a 
secure environment by ensurine that just one elerent of tre 
erstem (the security kernel) is sufficient to provide the 
internal system security. All accesses of data stored witnin 


computer system must be validated by the security 


kernel. 


15 





td 


E DO CcONGTmPTS/ADERSNITIONS 
Jo Ppocess 


Orsanicx [6] defines a process as a set of related 
procedures and data vndergoins execution and manipulation, 
respectively, by one of possibly several processors of a 
computer. nie process sa lozical rather than a p^ysical 
ERR ond con pe viewed as a set of relatec procedures and 
Gata (referred to as the process” ad¿íress space) and a point 
Re cution within that address space. mach process may 


nave associated with it such logical attributes as a 


I-A 
t 


meomrity class authorization and a unique identifier. 
order to execute, tre process must be mapned orto (bound to, 


EUical processor within the computer system. 


í 2 


PC GOCesseWagyrexi1St inm one of bonres states: bioczel, 
Bey, or running. «nen in a blocked state, the process must 
mere fOr tne occurrence of some event before execution cen 


continue (for example, an access of secondary storasel. “hen 


mr event for waich a blocked process is waiting occurs, th 


(D 


D 
a 
ct 


puscess ls places into the ready State which indicates th 
the process can run when a processor is aveiletle to te 
Ae nec to it. Thae process is in the running state wren it 


Mmemexecuting on a processor. 


14 





ER rocess swvitchina 


tra 


nen a process is tlocked, the physical vrocessor 


+ 


Ben alcensit 15 scneguled 15 idle. ror efficiency reesons, 
makes sense to freeze that process, save the execution 
pommt (prosram status registers, program counter, execution 
stack) and the address space, and then schedule ancther 


Epp: obo run on theft processor. This is referred to és 


(D 


process switching (or multiprcegramring), and is an imnortart 
F C Of a distributed operating syster. The overall 
system, such as SASS, can be viewed as a set of cocperatine 
puscesses that interact to perform the intendei functions. 
Meereient.  Drecess switching can only te achieved 
with the support of some hardware Switchine mechanism that 
Willi unload the blocked process” address space, and load the 
address space of the scheduled process. Some systems nave a 
Eu descriptor tase register) which is vsed to point to a 
list cf multivle address spaces (one per process} which 


ss in memory. Thus to change an address syeace, the DER 


tn 


Meee, Only te changed. Tne SASS utilizes a Z-EGe¢ suonportirs 
hardware device entitled a Memory "anacement Unit (MMU) to 
Senu efficient process switching. The MMJ consists of a set 
Of registers (64 or 128 in the SASS design) which contain 
the process’ address space. Thus process switchirg would 


mevolve the switchine of control to another hardware MMU (if 


a hardware MMI were available for each process}, or 


19 





alternately loading a software MMU irage (which is always 
mepueeeucrent) into the MM] whenever a process switch is 
mequimed. The SASS currently maintains a software MMU ¡mare 


Hoe each process. 


ee Protection Domains 


A user’s process executing on e computer system has 
an address space which includes the user provided procedures 
EEUU data, and also those portions of the distributed 
Meis system which are required to support execution of 
ese program. To maintain system integrity ana security, it 


Mares imandatory to protect the operating system from being 


altered or manipulated by tne user's procedures. To achieve 


ry 


this, the process” address space is divided into a set © 
hierarchical domains which ensure that the sezrerts of tre 
Operating system are protected from the user. Since the top 
MN design cf the operating system provides a strict 
Brerarchal structure, the domains of the overatine system 
EE also Mhierarchical in structure (viz., are protection 
rings). In the design of the secure operating system farily, 
Monee domains were defined: the user, the supervisor, and 
the kernel. 

Operating system segments which manere the actual 
shared physical resources reside in the kernel. The kernel 
ie most privilesed domain of the address space. It can 


be envisioned as a mini-operatine system that does all the 


16 





Becontree management. me security xerne1 segments 
(executable) can only te accessed within the xernel. Global 
(system wide) data bases are restricted to access by orly 
the security xernel to prevent tne possibility of an 
unauthorized inter-precess leakaze of information [7]. 

The supervisor domain resides between the most 
privileged kernel domain and the least privileged user 
domain. The supervisor contains those segments of the 
oOpereting system which are required to provide such common 
Services as ereating 3° hierarchical file system. Tre 
supervisor deals with the logical entities (segments) as 
viewed bv the user, and manages these segments by calls to 
m erne]. To preserve the integrity of the file svsten, 
the user is placed in the least privilesed domain, end can 
Euwunn)cate directly with the sunervisor only. 

Multiple protection domains may be implemerted via 
Aer a hardware and/or a software ring strvctvre. A 
hardware imolementation is more efficient, however the VLSI 
Mo processorse currently being manufactured provide for 
may wo protection domains. The present design cf the SASS 
ReQui res two domairs, separatine the supervisor end tne 
security kernel. The ZE@?@ microprocessor provides the SASS 
Da ine hardware rire structure tv providing two execution 
modes, the system mode and the normal mode. The xkerrel 
executes in the system mode and thus has access to all 


sezments, machine instructicrs, ard hardware facilities. Tre 
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Bipebyviser ex=cules im the normal mode, and thus only has 
o Sto a subset of the instruction set and seemenis. The 
Smery isor does not have access to those instructions which 
manipulate the system hardware, such as special 1/0 and 


Euecution mode contro? instructions. 
4. Segmentation 


Seementation is tne key element of a secure syster. 
DE -cement is a logical grouping of informétion such es a 
procedure, array, or data area [8€]. The address space of a 
ERCess consists of trose seemerts that may be acdressed ty 
that process. Segmertation is t^e management of these 
Segments within the address Space. In order to address a 
K TIC location within a segment two dimensions are 
required, an identification of the segment (e.z., Segment 
number) and an offset from the base of tne segnert. 

wach segment may have several logical attritutes 
associated with it. These attributes can include segment 
size, classification, and access permitted (read, write, 
execute). The physical attributes of a segment include tke 
current base address, and whether or not the segment is in 
core . The Seement/s attritutes and its pls doa Weeayion in 
Memory are contained ina segment descriotcr. The segrent 


MeechiptoOrs for a process are often contained ILE 


Qu 


Mio tor list (viz., an MMU image for the SASS) to 


meer itete the memory management of its address space. 


_~ 
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Seerentation permits multiple processes to share a 
single Seement and to avoid the requirement of maintainire 
mei catc copies ip memory. This eliminates the possibility 
of having conflicting data when multiple copies o? the same 
Seement are maintained. Segmentation also enatles e 
Emo rcement of controlled access to a particular segment, 
since each process can have different access (read/write) to 
BEE seements. This capability of enforcing controlled 
access 1s crucial to security. 

Segmentation provides a mecharism AOT the 
virtualization of memory (although rot provided in the 
SASS). If a user requests access to a Segment to which he 
we access rizhris, anºê that segment is not in main merory, a 
memory fault will occur which will cause that segment to te 
loaded into main memory (another segment mav have to te 
moved to secondary storage to make room). Thus tc the user, 
the size of mein memory is virtualized into the size of the 


process” address space. 


A arormation Security 


As previously stated, tnere is an ever increasing 
Demand for a computer system to provide for the secure 
ENE Se of information. Tnis security cannot be acded to én 
existing operating system with a large cegree of confidence 
that the resulting security system cannot be avoided or 


Baocesed. In order to te demonstretlv edequete, security 


j 





must be designed into the operating system, and must Pe part 
of the cornerstone upon which the operetine SySter is built. 

Moere aremt masl C aspect: of information security, 
we real Security and internal security. ixteraal security 
Brevents an infiltrator from getting to um @ C TIC 
a desired information is stored. This can be of such form 
as a fence, a safe, a sentry, or a guard dog. If an 
infiltrator manages to penetrate these external security 
measures, he then has access to the desirea informatior. 
Internal controls would consist of those security measures 
INS nato the computer which impede and if effective, 
prevent a compromise of information. If the internal 
Ene 50]1s function properly, information is provided and 
exchanged only witk the users wac are explicitly authorized 
meeess to that information. Many information systers are 
Huc red tc store and access information of different 
security levels (e.g., Secret files interspersed with 
Bemtraential and unclacsified,. The internal security of 
such a multilevel system must permit uSers and inforratiocn 
Berner simultaneously at difterert security levels, ard 
alse ensure that no unauthorized accesses (either 
intentional or unintentional) are permitted. The SASS wés 
designed to provide a multilevel secure Storaze environment. 

The data to te stored in a secure information system 
can be locked upon as a set cr logical objects such as files 


records. Associated with each of these objects iS a Set 


e 





EE ee lomevnhicienaye access rights to that otject. These 
access rights may include read access, write access, or a 
Some metion thereof. The non-discretionery security policy 
involves checking the object’s access class (oac) with the 
subject s access class (sac) to ensure that they are 
Memecttible. The access permitted is defined in a lattice 
model of secure information flow [S] as follows: 

sac = oac, reaG ana write eccess permitteos 

sac 2> oac, read access permitted 

sac < oac, po access permitted 

Tre government security classification system 
provides an example of a non-discretionary security policy. 
A Wer vita ae Security clearance of confidential is 
authorized read and write access to a confidential file (sac 
Sale). and ne has read access (tut not write) to an 
eet file (sac > oac). This restriction or write 
Bess is to prevent the inacvertant writing of confidential 
Meee into an unclassified file to which the subject may have 
Meni taneous access (this property is often referred to as 
MER property (10). Finally, tre confidential subject ¿ces 
not heve access to any secret files (sac < oac). 
psdiscretyYonary security policy lrvolves checking 

the subject against an object s access control list (ACL*. 
Maem subject only nas access to an object if he is included 
ts ACL. This policy is analagous with the government's 


need to know PONS ichan precludes a subject with a 


e 





Secret clearance from having access rights to all secret 
ro cmation' within tre system. He may access only that for 
which he has a need to Know . The discretionary security 
Ac nus allows the users of the system to specify who 
Mas access to their files. It is noted that the 
eescretionary Ser O cs. oO rerinement of tke 
security policy, and never permits a violation of the 
mem—-discretionary security policy in effect. 

The ENS was designed with the Lrt era 
men=discretionary security to be provided by the security 
Eme. Discretionary security is provided tv the supervisor 
mile system. The security kernel is based upon a 
Matematica! model which has teen proven correct. This 


5, 


mathematical model implements the system s security 
mebicies. 
The security kernel design has three prerequisites 


morder to provide a Secure environment: 1) the kernel must 


fI 
(D 
pa 
ct 
«> 
(D 
ry 


he isolated to ensure that it cannot be modifie 
meventionally or inadvertantly. This iS to ensure that tie 
behavior of the kernel cannot be modified. 2) Zeck and every 
attempt to access data within the system must invoxe the 
kernel. 3) The kernel’s correctness must be verifiable. This 
implies that the mathematical model must be proved and 


memonstrateéd as secure, and that the kernel implements this 


model. 





ADS ls STRUCTURES 


This thesis presents the detailed design of a remory 
Hara serent process for the SASS. Tne top Cown design 
Ro ENEE levels of abstraction used to 


` 


reduce the design complexity. The high level languege 
utilized was PLZ/SYS, which was designed to be compatible 
NN E 72 ¿Cl microprocessor. PLZ/STS is a blecx structured 


laneuare Similar to rasCäL. The compiler which compiles fror 


SS tc tne Zoevei instruction code is still in the 


ie 
Ou 
fu 


ASS O e to 


tJ 


developmental stage at ZILOC, INC. the PL 
therefore be "hand compiled (viz.,translated to tne FIZ/ASM 
assembly language) in order to run, test, and debug the 
Bade, Come of the procedures in tne lower levels of design 
(those which use privileged instructions to directly 
manivulate the svstem hardwere) must be directly coded using 
the assembly code FLZ/ASM. These procedures were deciareé 
EN uus to the Memory Manager FLZ/SYS molule and ere coded 
tae Memory Manager_PLZ/ast Module. 

Exerc tnescnesis presents ên overview of tne 
ES at its currert stage of Gevelopment. the design or tae 
Memory mancesement process, ¿nd the concurrent implementation 


of the distributed kernel processor management by Peitz (4) 


Hcc tte Original design of Parks and Colemén. Future 
Eu 0m tue SESS will rost litelv require sore refinemert of 


uu present desizn, 





Rene mi oresaris tre aetailes design of the memory 
manager module. This chapter emzhasizes why certain Jesiprn 
features were chosen, and how they were implemented in this 
desien. 

DINE c cnrapusEEESecents lhe stetus of research to 
mere, and attempts to identify what follow-on work is 


Eeer De PLZ/SYS code module and the PLZ/AS™ code 


tn 


module are presented as appendices. 
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This chapter presents an overview of the SASS in its 
Brent state of development. It is a simmation of the 
Ger inal desier efforts, and reflects refinements of those 
priginal designs. This overview is necessary in order to 
Uv understand tre thterreiationshlp between the memory 


manager and the overall system design. It also provides a 


current base for further SASS development. 


K ri pose of the S4: is tc previce a secure arerivel 
were storsre medium for a variable numter of nost comuuters. 


Were muiti-level irternal 


C) 


Bc xev desien goals of the SAS 
Miu ter security and controlled Sharing of cata among 
euceorized users. 

EM ups 71 provides par example oi how the 5455 coul&á be 
EIL Un tnis etampie, tnere ere four host comprters which 
side in four separate rooms (consider each of these 
m@emputers to be micrecomputers, although any computer could 
MEN utilizec;. Zach of the four hosts E used tn create anc 
ranipulate files Ou fixed predetermined security 
Mis prn For example, ell files created ty host #2 


are classified secret. Host #2 cannot create ton Secret, 
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Figure 1. SASS System 





Bom maential, or unclassified files (nor cer he access top 
secret in tris example). Access to eacn cf these Teens is 
Ren celly controllec o ensure that only personnel with tre 
proper security clearance are authorized access. Nene of tre 


Mee Systems neve a permanent local file storage device, ang 


C1 
tn 


ND aro haró-wired to an I/O port of the SA 


O 


ED NE csv controls ne access to 1ts 1/0 ports (host #4 


mu ustrates pos ley e nost aOrnee tle Geer en im 7 


Mm 


required ty tre Mor ines Mons acal mroteritiono ci the 


nard-wire is assummed to be adequate to miririze tre 


t 


Ae tility of such maiiícious activities as wire tapping o 
EIltrons Monitoring. Once a user of the nost svsten 


Mempletes his work, ke can permanently store is file cn tre 
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ES which is contained in the fiftn room o? figure 1 (view 


MS 55 as an LECL microcomputer with access to secondary 


ell we nser or O45 
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etorase devicesj. To gain access to 
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De host system must request the COS MN A 
EM en nis implies tnat jf "e Melicious user gains 
Bess o: the confidential Aost syster, ne still canrot 


meeess files of a higher classification. 


a a Ch see tasir 


(U 


BI | must te cepabl 
a mctions i ni j The functi EE 
! O AS environment. whese runctions are: l!' store 
ENSE for a Post system, 2) retrieve a file for a nost 


system, and 3) ensure that tte the files are made availatie 


ct 
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anly IN ea les he reari ea “Capability of file 


Mon ee anc retrieval implies that precesses must exist fer 
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EDD NENost system to perform file menas 
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ment 
El -ror behalf 07 thet host. To ensure the security cf 


~ 


eae tored information, the SASS must ersure that the user 


Aa speciric nost system may only adcress the files to 
which he as access. The SASS achieves the desired 


Seemronment  throust a distributed opereting system cesiegr 
consists of two primary modules, the supervisor and 
Mis ecurity vernel (tre security kernel actually consists 
DE distributed and non-distributed portions}. Fach host 
Memeo, which is herdwiread to tne SASS. communicétes with 
its own 1/0 process an? file manager process ir the SASS 
self. 

Men cnpervisor is responsible fer tre SASS-nest syster, 
er: ace. It constructs and manases & hierarcnicel file 


en tor its nost, based vgon the files which the 20st has 


«t 


a tted. and controls the actual I/O (both data and 
Commands) between the SASS ard the host syster. The 
per visor is built upon the security kernel anit ver 
NIEDOct' s reqvects (file storage, file retrieval. 1/2) Ur 
Calls to tre security kernel. These calls must he validate? 


(ty a fate keeper module in the SASS design) before the 


Mecurity xerrel *unction is invoked. 
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II cecuritv kernel conscicete of a distritut 
mem-aistrituted xerrel. The distributed rerrel is 
Rs tributed to (viz., is in the address space of 


Mess, and is resporsible for the multiplering of the 


AN 
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Several processes onto the actual har?ware processor(s', 
E orcine the non-discretionary EU PIS DOG v ano 
Maine tle Synchronization primitives for inter-»ro^ess 
communication. The non-distributed kernel consists of the 
memory manager process which is resvonsible for the secure 


Memerement of both main memory and secondary storage. secan 
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hardware processor must have its own remory ma 
mome-aictributec xerneéel) in the SASS design. 
An abstract system overview of the SASS is vresenteã in 


mures 2. Tour levels of abstraction were  vtilizec to 


m 


simvlifv tre design and understandability of the system. 


t + 


evel consiste o Re system nere yote whick “includes 


RE ZEÇY! milcroprocesser, tre local anã global memceriss, and 


tA 
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Eerondery storaze. The SA 15 designed to operate in a 
EEUU =microvrocessor environment. therefore each “rl! is 
Mn es 11ts on local memory (to which it alone hee access’ 
K ich it car stere process local sserents. Tre system 
Metas a global memory, which every CPJ mar access. 
Sesrents to which a usar process has write access must rte 
Mec” bat memory if more than one process kés 
simultaneous access to that segment. Tris is to ensure that 
HEN processes access the current copy of that shered 
writable segment. The basic storage policy is to store every 
ns i within local memory if at all possible. This is to 


“een bus contention between processors, wnich access global 


memory. to a minimum. 
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MI ote dlstributeca aná non-cistrituted 
zernel. The kernel is placed in (executes in) the most 
privilezed domain (system mode) of the ZE@e¢1 to ensure thet 
mimes protected from eny Manipulation (either malicicus cr 
Mmmeavertant’. The kernel controls all access to the system 


hardware hy meintaining ell privileged machire instructions 


Es hin its domain. Only the kernel may access these 


b ty 


mise ructions. The distributed kernel is respersible or 


Ape tine a virtual processor environment end enforcing the 
\ 

E crejionery csecvrity policy. It multinlexes processes 
E virtual processors and then multiplexes these virtual 
orocessor(s) onto the actual hardware processors. The 
Bee dıstriruted kerhel consists of the memory rerneser erd is 
Mermponrsitie for the secure marnefsement of totr mein memory 
and secondary storaze. 

Rss consists o tae Supervisor, which resides in the 
less privileged comain (normal mode) OR the 23201 
NE TOprocessor. Di has access Do all the marnine 
S (Or Ili the exception of tnose which menipulete 
the syster nardware. Tne supervisor must request the xernel 
memmove segments into and out of memory ard secordary 
storage via the E reeper (a softwere essisted 
rinsg-cressinra mechanism). The supervisor consists of two 
Hu oeste. processes for each hast, the I/C (input/autput! 
process ane the FM (file management) process. Er utilizire 


the 1/0 end TM processes the supervisor is etle to provide 
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n mi rn oc eG Virtue! file nierarcay for eacr heet systen. 
Fach host system has I/O and FM processes created ari 
assigned at system generation. They are ret üynamically 
created ung ebsgENPEESsuServiSor ensures that each 
segment’ s discretionary security is enforced. 

Ic consists 07 Mime host computer systems. These 
S. ra ars hardwire? to the 1/0 ports of the ZE¢¢¢. The 
Ders communicate with the SASS via System protocols over a 
communication link. Any computer system could serve as a 


meets With each host supporting multiple users, 
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Each host system is eSsiened the dedicated services of a 


evetem generation. Thece 
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memer Of Supervisor processes 
Mere sses are the I/C and FM prccesses. The FM process and 
ELE L»rocese communicete with each other via a shared 
segment entitled the mailbox . This ccmruricaticn is 
Memenronized via the kernel Synchronization vriritives wrich 
Bot upon eventccunts and sequencers [12]. A virtwel fi 
rem 15 created and maintained for each host by its FM ard 


I/9 processes. 
1. File Management Process 
MI procesc is. responsible for the management of 


@meenost s virtual file system within the SASS. The FM 
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DEED e rprets all the host commands anc acts upon them 
EN | ounctic" with tre I/O process. 


data 
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Mc nc enro Mme Rocst svyctem views his store 
Min tae SASS) as a hlerarchy of files. Figure 3 provides 
exemple of such a hierarchical file structure. To specify 
EE crt)icular file, e vethnare is required. The petknare is 
simply a concatenation of the file names (given to each file 
the user at its creation) starting at tke roct” 
meme ecvOry and procedine sequentially to the aesired file. 
conser is required to submit a pathnare with each cormard 
BRR fo the SASS. The five basic actions to be performed 
ER files at this level are: 1) to create a file (data or 
mmeectory), 2) to delete a file, 3) to read a file (data er 
lemme ctory)., 4) to initiate or modify file attributes (size, 
Oreo. ication, access permitted), and 5) to store (write) a 
ue. 


Ee 
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Preeessgiesteausregdstorecavert the pateanere 
EE ced tv tae vser, into one or morte segment numters. This 
EN ecessary because the notion o* a file is not  krowr 
Em oin the kernel. 111 files are composed o? segments. end 
must te referenced as segments within the kernel for 
Mon etion and management. Tne FM process mvst also 
provide appropriate cormand ‘andlers to nsere tha e 
Mer s reanested action is properly carried out. 


Raica S BSS Permits e ost te read or write the files 


another host, at the same security level, er 
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mecore tl onary access ie feeds 11leS of a icwer 
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eesi ication may be read only (if discretionary acces 
Berm: tted). This file sharing is achievec by creéeting a link 
between the two file hierarchies. This linx is entered inte 
wec tory file of the nost, and is constructed in the sare 
menner as a pathname (viz., it is a concatenétion of 
?ilenames). The kernel enforces a read only access to the 
momen classified files, which prevents the possitility of 
ne deta (through a link) of a nizher classification 
wa file cf lower classification. 

e cana ce mto ty tae IM. ¿process to panase 
the hosts files is the FM Known Segment Table (FM_ESTY, The 

/ 


MST is a list of those segments waich are anown to iviz.. 
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(D 


mE Un the address Space of) the PM process. Fierr 
provides an example of the ¿M_£ST structure. 

Jcenever a ser of a host Syster requests access to 
RR Co file, three AST lis seerched to determine if thet 
\ 
/ 


pathname (segment es ee mown. TO ii is crown, tre 


SD S L is passed to the kernel, via the gate keener, witn 
the appropriate segment number, for the desired action. If 
the pathname is not known, the segment number of tre desired 
NES s directory (parent) file an? ar entry num*er are sert 
to the kernel with the request to make that segment known. 


If the request is authorized ty the kernel, e segment number 
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urned. Tee returned 
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meee access mode authorized are 


sent number end mode are then entered into the rM 7S7 
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Figure 4. File Manager Known Segrent Table. 
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with that serment’s pathname. Once the segment is knowr, the 
NEE EE te serried ovt. 

The user requests to create cr delete files are 
Meo pessed to the appropriate kernel procedure, via the 
gate keeper, by the FM process (after a discretionary 


security check). No entries are added or deleted from the 


LA 


I ST during create cr delete requests (they invoke kerne 
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n add or delete entries from ë kernel 
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EO mitives whic 
base). 

Bonita 5672 process request trat a sSegrent te 
swanped into memory and memory is full, an @rror code will 


te returned to the FM process from the kernel (it is noted 
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EDU t^his às a per process memory allocation, thu 


memory State cannot be affected by its use ty other 
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cr 
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processes). The FM process will then select a segmen 


pamoved from core to make room for the desired seerent. Tre 


fu 
pa 
(D 
[er 
tn 
ct 
a 
(D 
O 
(D 
"3 
ct 
1— 
«i 


rent desjien calls for the invocation of 
Meters alzorithr (LRU) which maxes use of the FM KST use? 
Meera to Cetermine the leest recently used segment for swan 
gut. 

Discretionary Security is ERR OT CEA in the 
Eucretiorev security module of the FM process. An access 
EDO! list (ACL) iS maintained for each file within the 
MRS nierarchy. Tne ACL is simply a list of authorized users 
(a refinement of non-discretionary security) which is 


me@ererca tor each access to that file. The discretionary 
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Security module also performs the housekeeding functicrs for 
ne File". ACL. These functions include the eddition of a 
Mee ertry, the deletion of an ACL Gn r; and the 
Mi ialization of en ACL for a new file. 

mms notec nat the oerizinal desier cf the EM 
RES ESSs Conteined @ memory  merager procedure. This was 
necessary because the original SASS design called for the 
ED omues of memory such that each supervisor maintained 
his own core. The FM memory manazer menaged this virtual 
core by cells to the kernel via the gate keeper (swap ir, 
swap out). The current design of the non-distrituted kernel 


includes memory aliocation and thus has removed the need for 


+ 


he sunervisor to menage its own virtual core.  recause cf 


NEM c 6h memory maneger is not required. 


ER jnput/Output Process 


Mer O oroces: je responsible for all tre input end 


de 
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output between th25 supervisor and itae hcst computer system. 
EDEN process receives its commands from tne FM process 
via tre shared mailbox segment. 


Data is transfered between the nost systems and the 


(D 


SASS in fixed size packets . There are three basic tvpes of 


oacrets, a Synchronization packet. a cormand packet, and a 
Meme pacret. Protocols exist for the reliable transmission 
receipt of the packets by both the SASS and the host 


Systems. Tre Curent desisn pa SCHON (tao use of 





Elo ce protocols, which allows the sender to send 
reral paciete tefore he receives a receipt. 

meo ve ina lo su or the 1/0 process €ertained a 
Memory Manager procedure for the same reasons as the FM 
puscoess. This procedure is no loneer required due to the 


cesien of the non-distributed kernel. 


Meee islRI PUTED VERNEL 


Ie deslen o. the security kernel as presented 


` 


E I e7Tan [2], Fas been developed ty Reitz [4] an? tre worx 


Menea here. The primary refinements have treer the 


replacement of  block/wakeup [2] dy eventccurts, tre 
RS ion Oe am event mänafer walchE mta: ns. tne 
ExsUureonization primitives, and tre trarsães of EJ 


memerement to the memory manager. Figure 5 orcevides an 


overview of the security “Zernel design. 
1. Cate Keeper 


The gate keeper is a software pne cossirs 
Meemenism which is utilized to ensure that the security 
Meer js isolated and tamperproof. Tre mejor issues of the 


"UO ovade 3 rode switehineg 
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gatekeeper desizn are: 1 
mechanism for switching from normal (supervisor) mode to 


System (zernel) Io masza rardware preerpnt 


interrupts in the kernel, end Z) to check for virtuel” 
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Figure 5. Security Kernel Desier. 
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Emi mare oreembt | interrupts when leaving tz2 xernsi. Tre 
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EE Ee provides tne sole entry »oint into t^e xernel 
alin, no ere uest end its areunmezts, and 
Masters tie request to tíe aporcpriate xernel procedure. 
he cate xeeper encounters an error, it returns en 
Eenriate error code without irvoklng the xernel. 

Tete te keeper uses q perameter tetle to validate 
the user's request (call by value only). This table contairs 


IS O 


EN 
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tre number of parameters required by each ke 
(create sesmert,@elete segment, etc.), the type of each 


Seet STE, ard pe type er each return parareter. I? an 


Epor is ¿iscovered during tae validation process, it sets 


‘oe 


Na. messase Go an error cece. if tre request is 


Velid, tre sete <eever calls tne apprepriate «<errel module. 
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segment (or processor resisters’) within the supervisor's 
Eun. when tne gate teeper is invoked, it must first save 
E Sup=rvisor processor registers and then retrieve the 
ent list (via ar argument list pointer register). The 
Exeuments are validated and if correct. passed to tre 
mm@erepriate «ernel module. 

shen the kernel completes action taken unon tre user 
request, it returns to the gate Keever. Tne fate keeper then 
copies a return message into the return argument (thet is 


returned to the Surervisor's domain), restores tre 
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AMEN Sor. Ss environment, ee the irterrupts, ard razes 


EB up return back to the superviscr {viz.. changes the mode 


E S 


Es ez mert Manager 


AS Men Mana er is responsible DOE the 
management of the segmented virtual memory. There are siy 
Mmmerons which the segment maresger is cellec vpon to 


momen Teese functions are: 1) to create e ségment, 2, to 
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pe 


delete a seement, Z) to mare segment rnown, €) to maze a 


Qi 


segment un*novn (terminate), 5) tc swap a segment irtc core, 
AS) to Swap a segment out of core. 

The segment manager uses tne Known Segrent Tatle 
(EST) as its data base to manage segments. The FST is a 
process lccal kernel data bese which contains entries for 
EN e sesments which tre process has rede xnown. risure 6 
EN udes an example of the “ST structure. The FET size is 


Medi at system zererationr. It is indexed by Segment rvrters 


which are essiened by the sevyment manager. dnen a segmert is 
Meade known, a handle (the concatenation of the Global 
Active Segment Tahle (G_AST) index and the segmert’s unique 


meemtification’) is returned to the segment manager ty the 
memory menager. The fendie€ is a system wide unique 
Mmeemtification that is asSiened to each active Sesment 


Led Er ran 


Meee active in the G AST). The EST provices the mécpine 


Meeraenism for converting the serment number irto the 
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MM_Fandle Size Toce Core Class 


Figure €. Known Segment Table. 








eno Ss Unicue hemele. The use of the unique handle ty the 
puronenezer iS wnat permits tne cortrcllec snaring of 
meementsS by concurrent processes. Any process which requests 


Te a specific segment active will always be returne? 


í N 


that sesment's unique handle. Thus any one segment may exist 
within the address space of several processes (with e 
different segment number in each process) while residing in 
one location in merory. 

The SIZE field of the KST represents that segment” s 
meme. “Csrents exist in multiples of 256 bytes dve to Z-teec 


“MMU hardware constraints. An upper bound upen tne segment 


ENS ead at system generation by tae Cesien parameter 


Rm Mo isi ze. 6415 15 limitec to 05% bytes by naréware, 


EL o MCRE fieid states tne access duthorizec to the 
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egrent (read, write) by this process. Th 
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du 


Men ce process successfully requests the serment to te 
usr o into core. Tke CLASS field is used to give the 
r Class (€.¢., secret, confidential} of the seemert. 
hee isa! sequence of invekinge the sesmert manager 
mometions (sy the supervisor) would te as follows: 1) 
M@eate Segrent (this will invoxs the memery manager to 
assien a unique identification to the created Segment’, 2) 
Meena NOwn, which will place tke segment irte the KST, ang 
5) Swap In, which will move the serment fror serondary 


storage to main memory. To remove a segment from mein memory 





to secondary storage, the order would te 1; Swap Cut, 2; 
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Reco Unknown, and Z) Delete Segment. 


Oo. vent Manager 
The event manager provides the Eme 
Eucnronizaticn primitives era are used AOT the 


EmcDronization of concurrent processes ir the Supervisor of 


Be sen: scnocSea@esigen., Tre synchronization mechanism usec 
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Lat 08 evertcounts anc seguencers, first proposed by 
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Feed and Fanodié [1]. The use of eventcounts and sequencers 
Ms tie ordering cr events to te controlled directly "v 
mee processes involved, rather than to depend upon rutual 
exclusion mechenisns such as cemaphores. [he ze 
Sventcounts are rraintained in the memory manazer module as 


IN e a. ss tem wlüe entity and ere not process local. 


LO 


eed and Xancdie define an eventcount as an cbject 
meee xeeps a count of the number of events in 2 particule 
SS tat ^ave occurred sc far in the execution of the 
system. The event observed can be anytnine from tne input cf 
No tre system, = o writing @ particular segmert. The 
eventcount can be viewed as an integer value, which is 
Mmreremented with each occurrence of the observed evert. The 
mee tive ATVANCT/(X) is used to Sicral the occurrence of a 
Peete cular event, and causes tne evertcount À, associated 
Emu that event, to be incremented. The primitive  3E5ATÍZ"' 


mau c return the value of the eventcount X. The priritive 
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AE) will SuS pend the calling rrocess untii t^e value 


t 


(D 


Rr mom equal do E E 
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meee eventcount X is Er 
value n. 

EE dertined as an abstract object 
Mat can te utilized to totallv order the events of? a 
Meeprcular class. The basic purpose Of the Sequencer is to 


A e termine rege “a set of 


Or 


Provide a me 
occurerces cf a particular event. Lize the eventcount. the 
S C rn can te viewed as an integer value vwrich is 
increrentec each time the primitive TICYET(S; is called. The 
ED  " primitive is rasec unon the ticket machires often 
Meee in barsershops anc ice creem stores. Jhen e custorer 
ers. he tazes a ticxet. from which the order of wro 
arrived i Sut ang whom will he served reyt can Tte 


cetermined. 


rn 


N 
[N 


eee tos ewerteoun:e end sequencers by tne 
m i Or can be illustrated as follows. fuypose thai 
ent 2A is currently telne updatec Lv process one. 
Eventcourt A currertly has the value of 9 (the evertcount 
aesociatecd with the reading of segment A). Process two 
Bares to read seerent A, so he obtaias a ticxet ty 
zine the TICKET primitive associate with segment A. 


i value returned ty TICK“4T is 12. Process two row calls 


upon the primitive, AWAIT(A,12), which will suspend proc 
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Na t11 eventcount 4 is valued at 1%. Then process 
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EE his update, he will execute ADVANCE(&), whick will 


iA 
C» 





Mier =ment eventcourt 4 to tre value cf i£. Tris will allcw 
MAA ITA, 121 to retura to process two, which will then te 


allowed to read segment 4. 


m rol rye Controller 


o o a troll er performs "tae function of 
memecvlineg processes to run on virtual processors. The 
Meee ic controller couil be Cesigneé to schedule processes 
Eon directly on the hardware processors, but in this 
@esien, Recd s [I] notion of a two level traffic controller 
Meee Utilized. Thus the processes are first multiplexed onto 
Mal. processors by the treííic controller. The virtual 
Mrocessors are tren multiplexed onto the actral hardware 
Meee scOrs by the inner traffic controller. 

Ima ll orocessor is am abstract data structure 
No reserves all the ettritutes of a process in execution 
BENE processor (i.e., an executicr pocint and ar adéress 
Ee). Multiple virtual processors may exist for a single 
physical vrocessor. The Active Process Table (APT) is tne 
Dase utilized by the traffic controller to contol and 
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igure Y provides ar example of tre the AFT. 
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createc at system generation). Eécause of he sis 
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decision rot to create or destroy processes after system 
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memocess Index 


Priority State Next_Ready 
Me ive Processes 


Fizure Y. Active Process Table. 
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Be ran, tue initial entries junto the APT will De active 
Mem the life of the system. The index into the AFT is the 
RROCESS ID. 

Mera rem comprovem uses tae SRIOSITT field of 
Meer’? to determine which process to schedule for execution 
ea ce virtuel processor. The STATE field contains that 
e ss current state (running, blocxed, or ready). The DPR 
Mescriotor base register) field of the APT provides the 
address o? the MMU image fer that process. Tne Next Heady AF 
META iS a pointer which contains the index of the next 
Meee ss which is in the ready state. 

Tre design sirrlification choice of always having a 


- 


ducedgeeun 


= 
(D 
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ENUcess running on the virtual processors, intr 


Memon of en idla process for each virtual processor. Th 


(D 


A 


$ 


meee process is loaded onto a virtral processor and nlaced 
mo tne running state whenever the number of aveilatle 
email processors exceeds the number of ready or runnins 
Meocesses (excluding the idle process). The idle process is 
EN ^ lowest priority, and will only run if ne otner 
pu SS can de loaded. It is incapeble of blockine itself, 
and thus must always te in either the running or reedv 
sita te. 

Eur ue processor becomes .availatle, the 
Meare ic cortreller will te invoked to schedule the highest 
FS Tl Ly ready process which may run on that verticular 


virtual processor. If no process is ready, tne Idle process 
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Ee soils The Idle process provides a means to guarantee 
Miata ready process will alweys te found, and that the 
were Controller cannot te eyited without scredulire a 


EENEG ES 


ER inner Traffic Controller 


MIO Se o c EE controller is to 
Meevics the multiplexing of the virtual processers onte the 
actual system processor(s). and to provide the kernel 
aves for inter-process communication within the kernel 
Enna] and Mait). In the SASS design, each physical 


EE or nas a fixed set of virtual CPU's that EE 


O 
O 


Dr 


Uu 


mul tipierxes. The primary data base utilized hy the inner 
Mio controller is the Virtual Processor Table  (V?T, 


Figure 2 provides an eramnle of the YET, 


e 


I s Tri dezed by Tne Virtual Processor iL. Tze 


Jn tze sare ranner 


ty 
2 


Meee ORI, ard tne STATE fields are use: 
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ERR those fields in the APT. Tne Idle rlage simoly indicates 
Beine iela process is loaded on that virtual rrocesscr. 
EO Preempt flag indicates that a virtual vreemot interruot 
nas been directed to tnat sna PROCESS Or. Tre 
AS Frocessor eo era tat indicates wiir 
EE ware rrocessor that virtual processor is schearlea to 
ELEME n. one Next Ready VP is a pointer to the index cf tre 
KS 4]. virtual processor in tne V¥V°T for tnis CzT. 


mans OflAimal desizn, Coleman [3] tasxed the irrer 
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VP_ID 


Per} Pri | State Jale Preempt Phys Next SE 
Flag Flag PROC PAYNE list 


Figure €. Virtual Processor Table. 
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Meat fic controlier with the manaserent of tre hardware 
Yemory Maraeemert Units (which contain the process” address 
Space and its attributes) and the MMU software imares. In 
Mp resent  desien, this function has been assigned to tne 
memory manager. When the inner traffic controller urloads a 
MeeecessoOr, it simply writes the MMU into the MMU image in 
crier to save the segrent usage information. Te load a 
meocesS, it writes the “MU image inte the MMU. The rerory 


xp rr 


Manager insures that the Kei image is kept currert tv 


vodatine the images whenever a Segment iS Swadped in or 


meenppec out of memory. 

Mieres nea ronlzation primitives oi SICNAI anc 
EN are Maintainec within the irner traffic controller. 
Meese Oriritives are used by virtual processors within the 
Meee: domain to synchronize with other virtvel processors 


Main the kernel domain. 


RR NON-LDISOEIRUT?D KEPNEL 


ELS nor-distmibuted kernel is composed sclely cf 


E 


the memory manager process. EE EE processor has 
Memsociated with it, its own dedicated remory manager 
I SS. The purpose of tre process is the proper ard secure 
management of the main memory (both local and global), end 


Secondary storage. The actual transfer of segments from rain 


Memory to secondarv storage end vice-versa, is controlled by 





bee memory manager process. The primary data base utilized 


Meee tre process is the Active Segment Table. Chanter 3 


Emovides a detailed descriptien of the process” functions 


ea data tases. 
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ERR MeMO MANAGE: PROCESS DETAIL 


mee INTRODUCTION 


The memory manager is responsibie for the management of 
both main memorv (local and elotal) and secondary storage. 
ENS a non-distributed portion of the xernel with one 
Memory manaser process existing per physical processor. Tre 
memory manager is tasked (via signal and wait! to verform 
memory maragement functions on behalf of other processes in 
the system. The maior tasks of the memory manager are : i} 
fine allocation and deallocation of secondary storése, 2) the 
allocation ar? deallocatior of global anà local memory, 3) 
ment transfer from local to glotal memory (and vice 
Merse), ana 4) segment transfer frem secondary stcrage to 
man memory (and vice versa). There are ten Service calls 
Mma signal) which tasx the merory manager Process te 
E orm these functions. The ten service calls are: 

Or ci oe pa 
DELETE ENTRY 
ACTIVATE 
DsaCTIVATE 
STAT IN 

SNAP OUT 
DEACTIVATE ALI 
MOVE TO GLOPAL 
MOVE TO LOCAL 
JPDATE 


Upon completion of tre service request, the memory manager 


u i The results o“ the operation to the waiting process 


(yn 
ifs 





NS nal). Tt then tlocks itself until it is taszed to 
perform another service. The hardware configuration managed 
NIE memory marager process ic depicted in figure 9. The 
shared data bases used hy all memory manager processes are 
the Global Active Segment Table (G_AST), the Alias Tatle, 
the Disk Bit Map, and the Clobal memory Fit Map. The 
processor local data bases used bv each process are the 
local Active Segment Table (L AST), the Merory Vanaserent 


Mme, images anc the Local Merory Bit Man. 


Mel OICN PARAMETERS AND DECISIONS 


several factors were identified during the design cf the 
memory manager process that refined the initial xerrel 
design of Coleman[S]. The two areas tnet were modified, were 
the management of the MMU images and the manasemert of core 
Memory. oth of trese functions were managed outside of tre 


Memory manager in tne initial design. Tne inclusior of tnese 


Mmemct:ons in the memory menage 


' 3 


process sS. ccm y 
improve? the logical structure of t^e Cverall system Gesign. 
EN ts onal design parameters were established to facilitate 
initial implementation. These Gesign parameters recê to 
be addressed before the detailed desisr of the remory 
ELE er process is presented. 

ias decided to mare tne blocx/page size of both mair 


emery ano secondery storage equal in size. This was to 
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ANI Ate Tapoing algorithm from secondary storage tc 
Dum memory (and vice versa). In the initial desien tre 
blocx/vase size was set to 312 bytes. 

The size of tne page table for a Segment was Set at one 
page (non-pesed page table). Tuer was to simplify 


! 


implementaticn, aná had a direct bearing on tre maximum 


segment size supported in the merory manazer. For exemple, e 


YN 


ize of 256 bytes will adGress a maxirum segrert size 


tO 


age 
E 2.76- bytes, while a page size of 512 bytes will address 
EM Pement size of 131,272 bytes. 

Me Size Of the alias table was set to one pase 
(non-peged alias table). The numter of entries that the 
As tatle will support is limited ty the size cf the pase 
Maple (viz., a page size of 512 bytes will support up to 46 
entries in tre Alias Table). 

In the original deSien, tre main memory allocation was 


external to the memory menager. This y cuero tre 


0") 
Jl 
n: 
in 


partitioned memory manegement schere outlined ty Parysl2] 
and Coleman[3]. Ir the current design, all address 
assierrent and sesment transfer are manared ty the rerory 
nascer. This design choice ennanced tke generality of the 
design, and provided support for any memory menegerernt 
Scheme (either in the memory manager or at a higher level of 
abstraction!. However, the current design still res a 


meeermur core constraint for each prccess. 





Meana acement is not implemented in this 
design. Each vrocess is allocated a fixed size of physical 
Me. FOwever, it is not a linear allocation of physical 
memory. The design supports the maximum sharing of segments 


w ocal andi elobal memory. All segments that are not 


in 


hared, or snared and do not violate the reaCcers/writers 
problem will reside in local memory to eliminate the glotal 
bus contention. The need to compact the memory (tecause of 
fragmertation) should be minimal in this design due tc the 
E mum sharing of segments. If contiguous memory is not 
meilatilie, fhe memory manager will corpact main merory. 
meme compaction, the memory can be allocatec. 

The Se Ser cecision to renreser memcry as one 
momtieuous tlock (not partitioned) was made to Support a 
Eamic memory management scheme. Without êynamic memory 
management, the process” total physical memory can not 
EM ced the systems mein menory. The supervisor knows the 
Size of the segments and the size of the process’ virtual 
Sore, therefore it can manage the swap in and swap out to 
ensure that the process” virtual core has not been exceeded. 

Mpetae orisinal design, the vser's process inner-treffic 
controller maintained the software images of the memory 
Memerement unit. This design required the memory maneger to 
return the appropriate memory manacerent data  (viz.,Seemert 
location) to the kernel of the userís process. In the 


currert design, the software images of the MMU are 
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meintained tv the memory marager. A descriptor fase pointer 


E 
ct 


Memeo vided Cor phnhe inper-trafífic controller te multiplex 
Moe process address spaces. The MM image data tase does not 
med to te locked (to vrevent race conditions) due to the 
meet that process interrupts are maSked in the kernel. Thus, 
if the memory manager (a kernel process) is running then no 


other process can access the MMU irage. 


me system initialization process has not been eddressed 


= 


to ate. However, this desien has made sore assumptions 
out the initial state of the system. Since the memory 
manaser handles the transfer of Segments from secondary 
EE cec to malu memory, lt is likely to te one o? the first 
processes created. The memory maragerís core image will 
ëtt of its pure code and date Sections. The mirimal 
initialization of the memory manegerís data bases are 
entries for the system root and the suvervisor’s 5eemerts in 


ST and | AST(s), and the initializaton of the MM 


imazes with the kernel Sezgrents. The current desieon does not 


3 


MER for an entry in tne G AST or L AST for the kernel 
segments. Fowever, when system zeneration is designed this 
will have to te readdressed. 

The originall2] memory manager data bases have been 
S ty this thesis to facilitate the memory management 


un Lions. The major refinemerts of tse global and local 


Ave sesment tables are outlined in the following Section. 
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1. Glotal Active Segment Table 


The Glotal Active Seement Table (see figure 12) is a 
System wide, Shared data base usec by memory marager 
processes to manage all active segments. A lock/urlock 
Meenrcenism is utilized to prevent any race conditions from 
Occurring. The Signalling process locxs the G_AST before it 
Signals the memory manager. This is Cone to pnrevert a deadly 
embrace from occurring between memory manager procesSes, and 
also to simplify synchronization between memory managers. 
RE entire G 25T is locked in this design to simplify tne 
inplementation (vice locking Gach individual entry). 

eee! Size 1Surixed at compile time. The size of 
BEEN CD: Lhe product of the G AST record size, the 
RE mum number oí processes and the number of autrcrized 
Ben seements per process. Although the G AST is of fixed 
meee, 3t jis vblausitle to dynamically ranaee the entries as 
Eposec bw Picherdsor and O'Connell[1]. The currert nerory 
we eer design could be extended to include this dynaric 
manegement. 

Tre ümsewe Td Diele ES a unique segment 
E u'*ication rumter in the G AST. This field is four tytes 
EN and will provice over four tillion idertificaticn 


w Ers. A desien choice was made not to manage the 
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Figure 1g. Global Active Segment Table. 
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reallocation of the unique ió s. Thus when e segrent 
Me tes From the system, the unique id is not reusec. 

O E a Ge soem seid is used to indicate if a 
Meement resides in global cr local memory. If not rull, it 
contains the slobal memory tase address of a segment. A null 


entry indicates that the segment migat be in local 


JQ 


memory(s). 
l oc seso emma Mi riem e usec as a connected 


Beocessors list. The field is an array structure. indexed by 


y 


Mie Sortie. It identifies which L AST the segment is 


live in, and provides tre index into each of these tables, 


(D 
Es 


ELM cesis? choice of Maintaining an entry in the I AST fc 


T) 


^ 
LA 


te 


meee locally active Segrents irmvlies that if all entries 
BEEN rocessors LASTS + field are null, the segnert is not 
active and can te removed from the G_AST (viz.. no 
Eccescors are connected). 

Be us eta consists Of the written bit, anc 
REM writabtle tit. The written bit Ts set when a segment is 
Epe2 out of memcry, and the “MT image indicates that it 
mere been written into. The writatle tit is set ävrire 
sesrert leacing to indicate that sore process has write 
access to that Segment. 

INE neci wENUSEment is a leafs tne G_ ASTE # Parent 
ER provides a back pointer to the CAST index of its 
REC. This back pointer to the parert is importert durine 


EE creation of a segment. If a request is received to 


Oz 





create a segment which has a leaf Segment as its varert, 
Maen an alias table has to be created for that perent. Also, 
the alias table of the parents parent needs to be undated 
© reflect the existence of the newly created alias tatle 
(See figure 11). The indirect peirter shown is tne back 
@eanter to the parent via the G AST. 

Tre No Active In Memory field is a count of the 
number of processes ibat have the segment in global rerory. 
Mics used curíng swap out to determine if tre sesment can 
te removed from glotal memory. 

MM om eme icpencents field is =< count of tne 
number of active leaf segments that are dependent on this 
ERP, (viz., require that this segment remain ir tne G AST!, 


Sach time a process activates or deactivates a denendent 
E uent this field is incremented or decremented. 

nce field is tae size of the segment in bytes. 
ELM "c Table location field is the disk location of tre 
page table for a segment, ard the Alias Tatle Location field 
Mere cist location of the alias table for the segrert. The 
EN "able field car te null to indicate that no alias 
table exists for tke Seemert. 

The last three fields are used in the management of 
EEntcounts and sequencers [4]. The Sequencer field is vsed 
MOS sue a service numter for a segment. The Instance 1 


SMA. and Instance 2 field are eventcounts (i.e., are used 


mMemincdicate the next number of occurances of some event}. 
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er eurei. Alias Table Creation. 
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NO al 


The Local Active Segment Teble 


processor local data Dese. 


characteristics (viz., segment 


locally active segment. An 


Rat is active 


NUS] memory. The first field 


memory address of tne seement. If 


Emery, tris field is used to 


Spry is availeble or active. The 


a combination of segment number and authorized arress. 


array of records deta 


ue first 


to indicate the access (read or 


that Seerent. The second 


Seven tits) 
segment 


segment active. 


de Alias Table 


The alias table (see figure 


data tase which is associated 


the kernel. An aliasing scheme is 


systemwide information 


segments can only be created througt a 


O 
cy 


Active Seement Table 


number, 
entry exists 


in a process loaded” 


Strucruce that 16) inde ec 
record element (viz.,most 
read/write) 
Record 


Jeruseq to ma care the segment number. a 


wich 
used 


(uninue id.) 


(see figure 12) is a 


Mecenas Ts contados tre 


access) of 


for each segment 


on (oler l arc an 


A 


con talas tre 


the segment 1S pot 


vaea tenn r ether the L AST 


ent No C Cess field is 
is 


zu t 
— 
DIR È 


ey 


So ion mit ls used 
Permitted to 


denent (iz. the next 


null 


number indicates that the pro^ess does not have the 


13% is à memory manager 


each ron leaf segrert in 


to prevent vessino 


out of the kernel. 


wenter seerert ard 





Index # 





Memory Segment _ #/Access Auth 


Addr DER |  £| DER 1|DBR _2|DER_3|DER_4| [DER 5^ Eo 


Figure 12. Local Active Segment Table. 
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Entry 4 


Unique ID size Class Page Table Ras Table 
Location Location 


Figure 13. Alias Table. 
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entry number into the mentor s alias tetle. “hen a sesment 
is created, an entry rust be made in its mentor segrert’s 
alias table. Thus the mentor sefment must be known tefore 
that segrent can be created. 

The alias table consists of a header and an array 
structure of entries. The header has two pointers (viz., 
ANS addresses), one that links the alias table to its 
essociated sessment and one that links the alias tetle to the 
mentor segrent’s alias table. The header is provided to 
Men; Lhe re-construetion of the file system after a 
en crash dve to device I/O errors. It is not used at all 


HN n2» normal operations. Each entry in the array structure 
I J y 


identifying the created 


+, 
O 
e 


Eus)ets of five fields 
segments. The Jniaue Ia Teta contains melo upiaue 
Em Emtification number for tne seement. The Size field is 
Meee to record the size of the segrert. The Class field 
Mëtte the appropriate security access class of the 
segrent. The Page Table Locatior fiel2 has the disk address 
NE pese table. A null entry indicates a zero-lergtr 
Bent. the Alias Table Location field has the disk address 
EN the alias table for the segment. A nvll entry indicates 


that the segment is a leaf segment. 
4. Merory "Management Unit Imare 


The Memory Maragement Unit Imaze (MMU Imase) is a 


MED oro 1ocal data tase., It js an array structure that is 





indexed ty the DBR #. Each MMU _Irage (see figure 14) 
meciuaces a software representetion of the seerent descriptor 
pesisters (SDR) ?or the hardware MMU [12]. This is ir 
Ep the format used by the special 1/0 instructicrs for 
Moacing/unloading the MMJ hardware. The SDR cortairs the 
RC dress, Limit and Attritute fields for each loaded 
sesrent in the precess” address space. The Fase_Address 
field contains the tase adcress of the segmerts in memory 
(1ocal or global). The Limit field is the nurber of tlocks 
EN contisruovus storage for each segment (zero indicates one 
Mee), The Attribute field contains eiskt flags. Five flags 
EENM -ed for protecting the segment against certain types of 
access, two encode tne type of accesses made te the segment 


(read/write), and one indicates the special structure cf the 


'xj 


meement [12]. Five o? the eight flags in thes attritvte field 
are used by the memory manager. The “system only” and 
“execute only flags are used to protect tne code of the 
Meme! “ror malicious or unintertional mocifications. Tre 
“read only flag ie used to control the read or write access 
moma segmert. The change flag is use? to indicate that tke 
Seement has been written into, and the C>U-irhitit flar is 
Ned tc incicate that the segment is not in memory. 

nem lacit imo fields of the MMU Imace are tre 
Bock Used field and the Maximum Available Slecks field. 
These two fields are used in the mangement of each process” 


virtval core and are not associated with tne hardware MMU. 
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Figure 14. Memory Management Unit Image 
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SE emor, Allocation/Deallocation Bit Maps 


All of the memory allocatior/dealiocatior bit mars 
(see figure 15) are basically tne same structure. Secondary 
storage, £lohal memory and local memory ere managed tv 
memory bit rans. Tne Disx Fit Map is a global resource thet 
Mo tected from race conditions via the locxins convertion 
Eg tne G AST. tach bit in the bit nap is associatec with a 
END cor! secondary storage. A zero indicates a free blocx of 
storage while a one indicates an allocated block cf storage. 
EN oba) “emory Fit Map is used to manefe glotal memory. 
Mis a shared resource that is protectec from rece 
@enditions by the IO a of the Ze Tre 
Mica l Memory Pit Map is the same structure as itne 
ENS] vemory Sit Map and is used to manage local memory. 
local Memory Bit Map is not locked since it is not a 


Shared resource between memory manazers. 


BRR BASIC FUNCTIONS 


The detailed source code for the basic functions and 
MEN. line of the memory manager are presented ir appendices 
u P. Appencix À lists the procedures which are coded in 
Mets. «Wile Appendit F Lists the lower level hercwere 
cependert procedures which are code? in PIZ/ASM. 

EIVUSYS is a high level moduler etructvred  larrvuere 


which mvrocuces a mechine-independent Z-code similar to 


Sab 





Memory Bit Map 


mee 0123456789 


AJP 00 
CO d» 09 
DRM 
CNN 
e NN 
MN N 
NND 
PD 
NND 


ee et 
01254 


Figure 15. Memory Allocation/Deellocation Map. 
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Ae code. Jhe translator from Zrrode to Z-EGCE 
machine code is currently under development et ZIIOC Inc., 
nus the PLZ/SYS module could not be compiled on the Zecco 
[13]. PLZ/ASM is a symbolic assembly larguage that is used 
ëtt Eet pm the ¿-866f£. The assembler supports Structured 
meee reamming anc produces a relocatable 7-E@02 otject module. 

In the discussion of the memory manager desien, a 
Nn code similar to PLZ/SYIS is utilized. The rationale 
for using this pseudo-code was to provide a summary of tre 
memory manager source code, and to facilitate the 
presentation of this cesign. 

Rm is assumed trat the memory manager is initialized 
into the ready state at system generation (as previously 
mentioned). When the memory manager iS initially placed into 
mew running state, it will block itself (via e cell to the 
kernel primitive Wait). Wait will return a message from a 
Sienalline process. This message is interpreted tv the 
memory manager tc determine the requested function ard its 
meauwired arguments. The function code is used to enter a 
K c statement, which directs the request to the appropriate 
memory marager procedure. 

When the requested action iS completed, the memory 
manager retvrns a success code (and any additional require? 
data) to the sienalline vrocess via a call to the kernel 
I live Signal. This call will awaken the process which 


meouestecd the action to be taken, and place the returned 


KE 





message into that process” mesSase queue. then that action 
We completed, the memory manager will return to the tor of 
RE loop structure ard block itself to wait for the the next 
request. The main line pSeudo-code of the memory manager 


process is displayed ir figure 16. 


1. Create an Alias Table Entry 


Create Entry is invoked wren a user desires to 
create a Segment. A Segment i5 created ty allocating 
secondary storage, end by making an entry (uniqve_id, 
Meeondary storage location, size, classification) into it's 
mentor seezment's alias table. This implies that the mentor 
Segment must have an alias table associated with it, ard 
that the mentor segment must be active in order to obtain 
the secondary storage location of the alias table. 

The mentor segment can he in one o? two states. It 
may have children (viz., have an alias table), or it ray be 
a leaf segment (viz., not have an alias table). If the 
mentor segment has children, it has an aliaS table and this 
ENS table can te reed into core, secondary storage can be 
allocated, and tne data can be entered into the alias table. 
If the mentor segment is a leaf, an alias table must te 
created for that segment before it (tre alias table) can be 
read into core and data entered into it (see figure il). 

pel useludo-code for CRSATS ENTRY FROCFDU is 


presented in figure 1"7., The arguments passed to Create Entry 
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ENTRY 
INITIALIZE PROCESSOR LOCAL VARIASLYS 


DO 
! CHECK_IF_MSG_QUEUE_EMPTY ! 
VE ID, MSG ze WAIT 
FUNCTION, ARGUMENTS := VALIDATE MSG (MSG) 
IF FUNCTION 
CASE CREATE ENTRY THEN 
SUCCESS COLE := CREATE ENTRY (ARGUMENTS) 
CASH DELETE ENTRY THEN 
SUCCESS TODE := DELETE ENTRY (ARGUMENTS) 
CASE ACTIVATE THEN 
SIGs OOD R= eACTIVATS (ARGUMENTS ) 
CASS DEACTIVATE TEEN 
SUCCESS SECOND = DUAETIVAT® ARGUMENTS) 
CASE SWAP_IN THEN 
SUCCESS CODE ze S¥AF_IN (ARGUMENTS) 
CASE SWAP OUT TEEN 
SUCCESS CODE := SWAP OUT (ARGUMENTS) 
CASE  DEACTIVATE ALL TEEN 
SUR Oa PEACTIVATE ALL CAFG IMENTS \ 
CASE MOVE TO GLOBAL THEN 
Cias CE Cons = MONS) TO CLOFAL (ARGUMENTS) 
GAS"  sOVE TO FOCAL. THEN 
U NON TO LOCAL (ARGUMENTS) 
CASE UPDATE TEEN 
SIN SSS “COLE t= UPLATE (ARGUMENTS) 
FI 


NP ot De cUCCRss CODE, ARGUMENTS } 


~ 


END MEMORY MANAGER PIZ/SYS MODULE 


AS Memory Manager Mainline Coce. 


Gs 





CREATE ENTRY PROCEDURE (PAR_INDZX WORD, ENTZI £ WORD, 
= STO EL, CLASS FYTE) 
RETURNS (SUCCESS COLE BYTE) 
MOCAE PLKS WORD, PAGE TABLE LOC VORI 
ENTRY 
IF ALIAS TAESLE DOZS NOT EXIST THIN 
SNCCESS CODY :- CREATE ALIAS TAELE 
SS CONS <> VALID THEN RETURN 
FI 
rl 
BLES := CAICULATE NC 2LKS RFQ (SIZE) 
SUCCESS CODE := READ ALIAS TABLE ( 
G AST[PAZ S «ALTAS Tear Oe) 
NN UCcssS CODE <> VALID TH STURN 
FI 
SUCCESS CODE :z CHECK PUF ZNTRY ! in alias table ! 
NEC SUCCESS CODE <> VALID THEN RETURN 
FI 
BUSEESSS CODE, PAGE TAELF LOC :- £ 
Mm SICCESS CODE <> VALID TEE 
FI 
Bee ALIAS TAELE(ENTSY $, SIZE, CLASS, PAGE TAFLE_ICC? 
BUSCESS CODE :- WRITE ALIAS “TACIE í 
E I .INDZX].ALIAS TAZIE LOC] 


LLOC er Leg 
N 


ESTUÉN 


MR SUCCESS CODE <> VALID THE RETURN 
WSE SUCCESS _CODE := a: 
BI 


END CPEATE_ENTRY 


meuren. Create Sntry Fseudco-code. 
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Act ae index into the G_AST for the mentor segment, tne 
entry number into its alias table, the size of the segment 
to be created, end the security access class of that 
segment. The return parameter is a success code, which would 
be "seg created” for a successful Segment creation. 

When invoked, Create sntry will determine which 
State the mentor segment is in (viz., if it has an alias 
Men. If an alias table does not exist for the mentor 
segment, one is created and the alias table of the mentor 
seement’s parent is updated. The alias table is read into 
core and a duplicate entry check is made. If no duplicate 
entry exists, the segment size is converted from Lytes to 
Blocks, and the secondary storage is allocated for non-zero 
Ed seements. The appropriete data is entered into tke 
alias table and the alias table is tnen written back to 


secondary storage. 
2. Delete an Alias Table entry 


Delete Entry is invored when a user desires to 
delete a segment. A segment is deleted by deallocétine 
secondary storage, and by removing the appropriate entry 
from the alias table of its mentor segment (the reverse 
logic of Create Entry). This implies that tne mentor segment 
NE active at tae time of deletion. There are three 


conditions that can be ercountered during the deletion of a 


Vid 





EE -nentewPhe cegment to be deleted may be an inactive leef 
segment, an active leaf segment, or a mentor segmert. 

If the segment to be deleted is an inactive leaf 
segment (viz., has been swapped out of core, and does not 
have an entry in the G_AST), the Secondary storage can te 
deallocated and the entry deleted from the mentor segment’s 
r table. If the sesment is an ective leaf segment, the 
Segment must first he swapped out of core and deactivated 
before it can be deleted. This entails siegsnalline tbe memory 
Ku ser of each processor, in which the segment is active, 
to swap out and deactivate the segment. 

If the segment to be deleted is a mentor segment, en 
alias table exists for that segment . If the alias tabie is 
empty, the secondary storage for the alias tatle and tne 
segment car be deallocated, and the entry for tre deleted 
Sepment can be removed from its mentor s alias table. If the 
alias table contairs ary entries, the segment canıct be 
deleted because these entries would be lost. If this 
ponaition is encourtered a success code el 
"leaf segment exists is returned to the process which 
Mee sted to delete the entry. Due to a confinement protlem 
in upgraded segments, this Success code cannot always be 
Ed outside of the kernel. This implies that the segment 
manager must strictly prohibit deletion of a segment with an 


access class not equal to that of the process. 





BE P -endo Code TOn NY PACCEPURX ds 
Meesented in figure 16. The parameters that are passed to 
this procedure are the parent’s index into the G_AST and the 
entry number into the parent’s alias table of the segment to 
be deleted. The alias_table_loc field is checked to 
determine the state of the mentor segment (either a leaf or 
a note), ant tre appropriate action is then taker. A success 


moe is returned to indicate the results of this procedure. 
3. Activate a Segment 


Activate is invoked when a user desires to make a 
segment known by adding a segment to his address space. A 
EEnt is activated by making an entry into the L_AST for 
that processor, and tre G_AST. The activated segment could 
MO” one of three States; it could have previously teen 
activated by anotner process and nave a current entry in 
Iun the C AST and L AST, it could have previously been 
mei va tec hy anotner process on a different processor and 
have an entry in the C AST but not tbe Li, AST, or it could De 
active and have an entry ir neither tine C AST nor the 
IT. 

M coc uen EM»eU activated already has entries 
Both the LAST and G AST, these entries need only be 
Epated to indicate tnat another process has activated t^e 
segment. The segment number is entered DIOS, tae 


E ment No/Access Auth field of the LAST, and if the 


CY 





DELETE _PNTEY PROCEDURE ( PAR INDEX WORT 
RETURNS (SUCCESS COLE BYTE) 
LOCAL PAR INDEX  4CRD 


ENTRES 


ENTRY_# 


WORD ) 


| Check if the passet mentor segment ras an alias table. 


IF G_AST[PAR_INDEX] 
eco. con: 


„ALIAS_TAELE 
:= READ ALIAS 
G AST[FAR INT 


DATES T 
DEXJ.AL 


LOC <> NULL 


TAS TABLE LOC) 


RETURN 


MEL 


AS IONES 


: 


ID to verifv segment inactive 


INDEX) 


ES 


ELSE 
EUER SSECODESUZ C NOSGCEILD TO DsSL5Ts 
FI 
SUCCESS CODE <> VALID TEEN 
rl 
! Determine if segment has children in alias table ! 
Ir ALIAS_TAELE NOT EMPTY TEEN 
EU Ss _CODE = LEAF SEGMENT EZXISTS 
STURN ' Deletion will delete children 
SESE. 
mereerch G AST with UNIQUZ. 
IF ACTIVE INC AST TEEN 
eg li active in AST | 
DSTI VEINE D ASIT THAN 
DEACTIVATE _ALL LD AST INDZK, 
FI 
Beck CE AST to verify segment inactive in otker 1_4ST“s 
RR SCI IME IN OTEER LAST O TEEN 
SIGNAL. Dos DEACTIVATE “ALL 
FI 
FI 


FPEE_SEC_STORACE 
_ATIAS_TABLE_ENTPY 


Datars 


FI 
DENKT 


Rg sia 


PATAS UTA ELO ENTRA 
SUCCESS CODE 


= waits 


AS El 


ee 


SÉ ps 


G AST[PAR_INDEX].ALIAS_TAELT 100) 


Br SUCCESS CODE = TALITI 
SUCCESS COTE := 
FI 
END DELETE_ENTRY 
Figure 18. 


TFEN 
SEG DELSTED 


00 
EA 


Eeer PSeuco=code. 


! 


! 





segment is a leaf, its mentor's No Active Dependents field 
EN c6 A57 15 incremented. In this design, the G AST is 
always searched to determine if the segment has 
previously activated by another process. 


If the segment to be activated has an entry in the 


i3 


EST but not the L AST, an entry must be made in the L AS 


e 


ae G_AST must be updated. The LAST is searched to 
determine an available index. The Sermert number iS entered 
Bene TE T and the index number is entered into tne 
EE Processors L AST$S # field. If the seerent to te 
activated ic a leaf segment, Its mentor’s 
EN vive Dependents field in the G_AST is incremented. 

If the activeted segment does not have an entry in 
Beer the C AST or L AST, an entry must be made in Dota. 
MEG TAST às searcneê to find an dvailetie index, énd the 
Meee is made. The I AST is then searched to fird an 


ND sble index, and the entry is made. The 1_A4ST ircex is 


CT leg 


it 
^79 
He 
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pa 


K ertered into the C_ AST Frocessors_Il ASTZ_ 
EE "voted segment is a leaf, the No_Active_Tependents 
field of its mentor’s G_AST entry is incremented. 

SEO code fOr ACTIVATS PnOCESUPE às presented 
Mim figure 19. The parameters that are passed are the DER & 
of the signalling process, tne mentor segmént’s index into 
the G AST, the alias table entry number, and the segrent 


number of the activated segment. The mentor Segment is 


always checked to determine if it has an associated alias 


Ei 





ATEN PEOCEDARD (DER _* EYTE, DAR INDEX WORT, 
ENTRY £ WORD, SEGMENT NO EYTE) 
RETURNS (SUCCESS CODE EYTE, RET C AST EZNDLE FANDI 
CLASS 3YTE, SIZE WOED) 
LOCAL GC _ INDEX WORD, L INDEX WORD 
ENTRY 
Mmeverity that passed segment £5 a mentor segment ! 
IF G _AST[PAR INDEX] ALIAS TABLE LOC <> € TEEN 
SUCCESS COOLS := T ALIAS TAEDE ( 
EEN ALIAS TABLE IOC.) 


= 


Bees 
SUCCESS COLZ := ALIAS DOZS NOT EXIST 

FI 

IF SUCCESS COTE <> VALID THEN RETURN 

FI 


Beck G AST to determine if active ! 
me GOtSS CODES, INDEX := SEARCH G AST (UNIQUE ID, 
DEES COLE = FOUNE TEEN 
IF SEGMENT IN L AST TEEN 


UPDATE LAST (SEGMENT NO) 
EISE 
MAKE L AST ENTRY (DBE &, SEGMENT_NO) 
UPDATE G AST (L INDEX) 
IF Be ASTLINDEX] .ALIAS TABLF_IOC = NULL TEEN 
E AST[PAR INDI EX] .NO “DEPENDENTS. Lelia == 
FI 
FI 
ELSE 
MAXE G AST ENTZY (ENTR Le 
MAKZ I AST ENTFY (PAE INTEZX, ENTRY ai 
FI 


SUCCESS CODE := SEC ACTIVATED 
END ACTIVATE 


Fisure 19. Activate Pseudo-code. 





table. [í it does not, the success code of 
“alias does not exist is returned. If the alias tatle does 
exist, it is read into core and the entry number is used as 
an index to obtain the activated segment's unique id. The 
EN is then searched to determine if the segrent Las 
Reg been activated. If the unique id is found, the G_AST 
is updated and the L AST is either updated or an entry is 
made (depending on whether an entry existed or not). If the 
Moue id of the segment was not found during the searck of 
MESAS, an entry must be made in both the G_AST and 
AST. Activate returns the activated Segments 


messification, size, and handle to the signélling process. 
€. Deactivate a Segment 


Deactivate 1s Invoked when a user desires to remove 
a segment from his address space. To deactivate a segment, 
ER memory manager either removes or vpdates an entry in 
both the L AST and G AST. Deactivate uses the reverse logic 
BENE vate. Once a segment is deactivated, it can only te 
reactivated via its mentor” s alias table as discussed in 
activate. If a process requests to deactivate a Segmert 
which has not been swapped out of the process” virtual core, 
the memory manager Swaps the Segment out and updates the MMI 
image before the segment is deactivated. The segment to be 
EExctrvated could be in one of three states; more than ore 


process could concurrently hold the segment active in the 


ES 





MS Lhe segmeri could be neld active by one process in 
meee | AST and more than one in tne G_AST, the segment could 
Iu eld active by only cone process in both the L AST and the 
C AST. 

Deactivation of leaf segments and mentor segments 
are handled differently. If the segment is a mertor segment 
free active dependents, it cannot be removed from the 
G AST (even though no process currently nas that segment 
active). This is based on the desien decision which requires 
that the mentor of all active leaf segments remain in the 
G_AST to allow access to its alias table. The mentor” r alias 
table must Þe accessible when an alias table is created for 
a dependent leaf segment. If a leaf segment is deactivated, 
the No Active Dependents field of its mentor’s G_AST entry 
is decremented. A mentor segment can only be removed from 
MN AST if no process holds it active, and it has no 
active dependents. 

EE one nrocess concurrently hold a cegmert 
active in tne I AST, and one of them signals to deactivate 


Ne cement, the entry in the LAST is updatec. This is 


in 


accomplished by nulline out the Sezrent No/Access Auth field 
EN C LAST for the appropriate process. If required, the 
No_Active Dependents field of its mentor segment s G 4ST 


entry is decremented. 





o mM ame process aolàs the segment active in tre 
NE aia that Process Signals to deactivate the seegrent, 
mee IL AST entry for that segment is removed. PRE 
Processors I ASTE s is updated and checked to determine if 
there are other connected processors. If there are no other 
connected processors and the segment has no active 
dependents, the segment is removed from tne G AST. if there 
meer other connected processors, the G AST is updated. If the 
deactivated segment is a leaf, the mentor segments 
ive Lependents field it the G_AST is decremented. 

The pseudo-code for DSACTIVATS PRƏCZ LURE is 
presented in figure 22. Tke parameters that are passed to 
the memory manager are the Dog sg of tne signalling process, 
meee tne index into the G_AST for the segment to be 
rated. Ihe procedure first updates the L_AST, and then 
usuoves the entry if no local process holds the Segment 


Ee. The G AST is then updated, and its mentor segment is 


30 "EE 


ps 
(D 


checked (if the deactivated segment was a 
EN Une ii it can te removed. If no processes currently 
more the segment active, and it has no active devendents, 


BRR Secrent is removed from the G_AST. 


5. Swan a Segment In 


SWAP_IN is invoked when a user desires to Swap a 
segment into main memory (global or local) from seconéary 


Storage. À seement iS swapped inato main memory by obtainine 


25 





DEACTIVATS PROCEDURE (DBR _# BYTE, PAR INDEX WORD) 
RETURNS (SUCCESS CODE BYTE) 
EOC AT INDEX WORD 
ENTRY 
! Check if seement is in core ! 
IF G AST[INDEX].NO ACTIVZ IN MEMORY <> Ø THEN 
! Check MMU imaze to determire if in local memory ! 
(ene LOCKE MEMORY TEEN 
Success Corr oe (DEAR, INDIR) 
FI 
FI 
Emi move process segment no entry in L_AST ! 
L_AST[IL_INDEFX] .SEGMENT_NO/ACCE3SS AUTE[DBR_ +] 
CHECK IF ACTIVE IN LAST (LAST INDEX 
IF NOT ACTIVE IN I AST THEN 
MENT INDEX| MEMORY ADDR := AVAILASLE 


II 
FE 


EI 
! Check if deleted segment was a leaf ! 
IF G AST[INDEX].G ASTE e PAR <> @ THEN 
G E USER INDEX] .NO_ DEPENDENTS ACI ee 
! Determine if parent can be removed ! 
CHECK FOR REMOVAL (PAR_INDEX) 


Es 


PI 
E Determine if deactivated sesment can te removed ! 
CEECK FOR REMOVAL (INDEX) 
EEECESS CODE := SC are rivers 
END DEACTIVATE 


igure 2¢. Teactivate Fseudo-coce. 
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the secondary storage location of its page tatle from the 
Meet, agilocatine the required amount of main memory, and 
reading the segment into tne allocated main memory. The 
segment must be active before it can te swapped into core, 
and the required main memory space must te available. Three 
conditions can be encountered durine the invocation of 
K ioe segment can already te located in glotel 
memory, the segment can already be located in one or more 
local memories, or the segment may only reside in <econdery 
Storage. 

Ie se Smemem1S NOL In 10231 Or global mernory, 
local memory is allocated, the segment is read into the 
allocated memory, and the eppropriate entries are made in 
o image, the L AST and the G AST. if the segment is 


already ir global memory, it can be assumed that the seerert 


L-Ae 


s shared and writable. Ir this case the only required 
actions are to update the G_AST and JI #5T. The 
END ve In Memory fiezd of the G AST entry is incrementec, 
and the MMU image is updated to reflect the swapped in 
seement’s core address and attributes. 

If the segment already resides in one or more local 
memories, it must be determined if the segment is ‘shared 
ERRO writable . A segment is shared if it exists in rere 
than one local memory. A segment is “writatle if one 
process has write access to that segment. If the segrent is 


Eu chared or not writable and in local memory, the 





appropriate entries ere updated in the MM) imase, the L_AST, 
and tre C 35T. If the Segment does not reside in local 
memory, tke required amount of local memory is allocated, 
the segment is read into the allocated memory, and the 
Mepropriate Entries are made in the MMU image, the LAST, 
and the G_AST. 

= coments. shared. writabie, and in local 
memory, the segment must be moved to global memory. If the 
sesment is not in the memory merager's local memory, it 
signals another memory manager to move the segmert to elobal 
EN rv. After the segment is moved to global memory, the 
memory manager signals all of the connected memorv manager”s 
a date their L AST and MMU dete beses. When ell local 
data bases are current, the memory manager updates the S AST 
returns a success code of seg activated. 

j psecudo-coce cor Shr IN PROCEDURE is presented 
MN icure 21. The arguments passed to SWAP IN are the 
G AST INDEX of the Segment to be moved in, the process” 
Meme, and the access authorized. SWAP_IN will convert the 
Seement size from tytes to blocks, and verify that the 
process” core will not te exceeded. If the virtual core will 
be exceeded, a success code of "core space exceeded" will te 
red. if write access is permitted, tne writeble tit is 
Set. Checks are then performed to determine the seprent’s 
meorage location (local or glotal), and the appropriate 


actior is taken. 
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SWAP IN PROCEDURE (INDEX WORD, DEP 8 BETTE, 


END 


ACCESS AUTE BITE) 
RETURNS (SUCCESS CODE BYTE) 
LOCAL L INDEX WORD,  BIÉS WORD 
ENTPY 
ENS RE CALCILATE NO. OP pEKS (G_AST[INDEX] .SIZE) 
SUCCESS CODE := CEECK MAX LINEAR CORE (ELKS) 
ISO SS cORa = VIRTUAP LINEAR CORE FULL TEEN 
RETUSN 
FI 
C AST[INDEX].NO SFGMENTS IN MEMORY -- 1 
IF ACCESS AUTE - WRITE THEN 
TIN E El TS us WRITALLE EIT SET 
FI 
Perermine if segment can be put in local memory ! 
IF C OASTIINDEX].zLAG ETS TANTO IBA VASE = ¢ 
ORIF G_AST[INDEX].NO_ACTIVE_IN_MEYOEY <= 1 THEN 
! Determine if already in local memory ! 
Ge Ok LOCAL MEMORY (L_AST INDEX) 
IF NOT IN LOCAL MEMORY TEEN 
ALLOCATE LOCAL MEMORY (BLES) 
READ SEGMENT (PACA TARLE LOC, EASE ADDR) 
SIDO ; BASE ADD? 


IF NOT_IN_GIOFAL_ MEMORY TEEN 
UPDATE MMU 
UPDATE LAST 
RETURN 


ALLOCATE GLOPAL MEMORY (BLXS) 
IF IN LOCAL_MEMCR{ TEEN 

“OVE TO GLOBAL (L INDEX, BACT ADER, SIZI) 
BLSZ 

SICNAL OTEER_ MEMORY MANAGERS (INDEX,EASE_ ADDR’ 
FI 

FI 

FI 
UPDATE VMU IMAGE (DBR &,S20 #,5ASE ADIR,ACCHSS,ELKS) 
UPDATE L AST ACCESS (L INPZ ax „ACCESE, DER 4) 
SUCCESS COTF :- SWAPPEP IN 

SWAP IN 


Aire 21, Swap In FSeudo-code. 
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6. Swap a Segment Out 


EREMO UMEN oro When a user desires to move a 
segment out of core. A segment is swappec out of core ty 
Merpcdining its secondary storage location, writing the 
segment te that location (if required), and deallocatirg tae 
main memory used. The decision to write the segment is 
Mebermined ty the G AST written bit. This bit is set 
whenever the segment nas been modified. The segment to te 
EN pped out car he in one of two States? t5e segment can te 
ENM5cal memory, or the Segment can be ln global memory. 

If one process aas the segment in local memory ard 
the written bit iS Set, the Segment is written into 
Becondary storage and the local memory is deallocated. If 
MSN Ti tten bit is not Set, the local memory need only te 
Besllocated. If more than one process has the segment in the 
same local memory, the segment remains irn core. The 
Emo priate MM! image is updated to reflect the segments 
meletion ene tne GIAST No Active Ir demcry field is 
mecremented. 

All segments in global memory are shared and 


writable. If a process requests the sezment to te swanped 


out, the segment remains in memory. The MMU image is updated 


to reflect the Seement Ss deletion, and the G_AST 
No Active In Memory field is cmn ed. les US 


ct 
T. 
(D 


No Active In Memory indicates that one process has 





ae ment in core, 1ts memory menaser is signalled to move tre 
segment to locel memory. 

MISS Uno cone tor SJAE OUT PrROCEALURE is presented 
in figure 22. The arguments passed to SWAP OUT are the LSP # 


Lm dm 


END. sienalling process, and the € AST INLEX of the 
HE ment to be removed. Ine return parameter is a success 
code. SWAP OUT removes the segment from the process s 
virtual core, deletes tne segment from its MMJ image, and 
decrements the No_Active_In Memory field. If the segment can 
he removed from memory, it is determined wnich memory can ts 
deallocated. If the Seement has been modified, it is written 
back to secondary storage anc the appropriate memory 
deallocated. If the Seemert has not been modified, the 
meeropriate memory is dealloceted. If after the deletion one 
process has the Segment in global remory, its memory manager 
need only be signalled to move the segment to local memory. 
Wien SWAP OUT successfully completes, lt returns a success 


code of “swapped out’. 
7. Deactivate All Segments 


DEACTIVATE ALL is invoxed when it becomes necessary 
to remove a segment from every process” adúress soece. Zach 
process 1s checked to determine if the segment is active. If 
Bitte ee base the segment active, it is Geactiveatec from its 
Tess space. The pseudo code for Deactivate all is 


fekt ra teg in figure Lc parameters passed to 


31 





SWAP OUT PROCEDIRE (DER_# 


END 


E INDEX WORD) 


— t 


RETURNS (SUCCESS CODE BY 
ENTPY 
Bec) >= GC ASTIINDEX] .SIZS / BIKE. 
FREE PROCESS _ LINEAR TIE D 
DELFTY mma FNTEY (PPZ _#, SEG 4) 
G AST[INDEX].NO SECMENTS IN "ZMORY --» 1 
Determine if segment has beer written into ! 
IF MMg IMACE[DER *)].SDR[SFG £].ATTRIEUTES-WRITTZN TEEN 
! If segment nas been written into, update G AST! : 
G_AST( INDEX] .FIAG_BITS := WRITTEN 
FI 
Determine if segment is in global memory ! 
NETAS? INDEX]. CIOBAL ADDR <> NULL THEN 
ine) CG _AST[INDRX]. NO SEGMFNTS IN MEMORY = 
ANDIF G _AST[INDEK] „FLAG. RITS = WRITTEN 
WRITE SEG (PAGE TABLE LOC, MEMORY ADT 
FRE? LOCAL BIT MAP (MEMCEY_ ADIR, IES) 
EISX 
IF G AST[INDEX].NO ACTIVE IN MEMORY = + 
FREE ILOCAL FIT MAP (MEMORY ADIA, ELKS) 


D +39 


Ms 
| 
de 


tx{ 


I 
ELSE Otal memory ! 
IF G AST(INDEX) .NO ACTIVE IN MEMCET = £ 
ANDIF € AST(INDEX). sh = WRITTEN THEN 
Wine AGE PASTS LOG, GLOBAL ATIF) 
FOES GLOBAL BITTMAP (CLOSAL ADDR, EILS) 


uj 


ELS 


t+] 


PEC Mem INDEX] .NO ACTIVO IN “MEMORY = N 


¢ TE 
FREE GLOBAL_EIT_MAP (GLNBAL ADDR, 3IZ:) 
FI 
PI 
ET 
ENUCESS CODE :s SWAPPEP OUT 
SWAP OUT 


Nela Out ESeudo-code. 





EEV ATE ALL PROCEDURE (INDEX JORD, L INDEX WORD) 
RETUPNS (SUCCESS CODZ EYTE) 


ENTRY 
FOCAL I FYTE 
I := € 
DO 
IF I = MAX DBR 4 THEN 
EXIT 
FI 
Pee ol WIDER) ooeMENT NO/ACCESS AUTH [TI] 
© JE Oe TEEN 
SUGGUSS CODE = DrRACTIVATE (I, INDEY) 
INE USB CODE She DANCTIVATED TEEN 
RETUEN 
FI 
FI 
I += 1 


OD 
86:05 CODE := VALID 


IND DEACTIVATF ALL 


Figure 23. Deactivate All Pseudo-code. 





Deactivate_all are the deactivated Seerent’s G_AST index and 
NAS dex Toe | AST is seerched by LEY # to cetermine 
which process has the segment active. If the check reveals 
Mat the segment is active, it is deactivated by callire 
Deactivate. If the segment was successfully deactivated from 


RN processes, e success code of valid is returned. 
8. Move a Segment to Global Memory 


RS EE invoked when it Lecomes necessary 
to move a segment from local to global memory. If a segment 
resides in one or more local memories, end & process with 
write access swaps that segment inte core, or if a segmert 
resides in in local memory (with write access} and another 
process with read access requests the segment swapped in, 
M@emocerent 15 mevec from a local to global memory to avoid 
a secondary storage access. If the segment resides in the 
running memory manager's local memory, it will affect the 
sesrent transfer, otherwise it will signal another remory 
Memadeer of a connected processor to affect the transfer. 
rus 22 illistrates the pseudo-code for MOVA TO GIOSAL. 
Once the segment has been moved to global merory, the 
signalled memory manager will upéate the MMJ images for all 
connected processes, and deallocate the freed local memory. 
A success code of completed will be returned to the 
Signalling memory manager. The varameters passed to tre 


memory manager are the segment“s L AST index , the global 
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MOVE TO GIORAL PROCEDURE (I INDEX  4ORP, GLOZAL ADDE WORD, 
SIZE WOPD) 
RETURNS (SUCCESS CODE ?YT3) 
ENTRY 
mereve seement from local Da! to global memory ! 
DO MEMORY MOVE (MEMORY ADD?, GLOBAL_ADDR) 
L AST[ INDEX] .MEMORY_ADDR = AVAILABLE 
moaare the MMU irage to reflect new address ! 
DO PDP ALII DBR“S 
IF L AST[L INDEX].SEGCMENT NO/ACCSSS AUTE <> £ ANTIF 
MMJ IMAGE[DER_#]. SDF (SEG K LE EESTI VOGAT I EN 
MMU IMAGE [DER ei. SDR[SZG “RI .BASE ADOF:=CLOEAL AIDP 
FI 
OD 
SIC CESS CODE := VALID 
END MOVE TO GLOBAL 


Figure 24, Move To Global Fseudo-code. 
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Memory address of the move, and the size of tne segmert. 


Eus information is passed because the G_AST is locked 


Morning this request. 
9. Move a Segment to Local Memory 


DN IO ais inyoMed wren àt becomes necessary 
Ro move a Segment from global to local memory. This occurs 
wher one of two processes which hold a segment in global 
memory Swaps the Segment out. The Segment is moved from 
global memory to the local memory of the remaining Process. 
mere co iliustrates the pseudo-code for MOVE TO LCCEL. The 
varemeters passed to the memory manager are the serment’s 
NETA: the global address of the segment, and the size 
Berne segment. The return parameter is a success code. The 


MMU images of the signalled process are updated after tre 


move has been made, and the global memory is dealiocated. 
12. Update the MMU Image 


WEE is Invoxea followine a Horns DONGIOPALD 
Operation. After a segment has been moved from local memory 
Me lotal memory, it is necessary to signal the memory 
Mmeacers of all connected processors to update their MMU 
meres and L AST with the current location of the segment. 
They must also deallocate the moved segment's local remorv. 


Mere 26 illustrates the pseudo-code of UPDATE. The 


parameters passed to the memory manager are tre Sesment's 
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MOVE TO LOCAL PROCEDURE (L INDZX WORD, GLOBAL_ADDF WORD, 
iz? WORD) 
RETURNS (SUCCESS CODE BY 
ENTRY 
PLKS IZ ELE SIZ} 
BASE ADDRESS := AILOCATE_LOCAL_MEMORY (3IXK<) 
! Es. from elobal to local memory ! 
MEMORY MOVE (GLOEAL ATDE, FASE ADDRESS, SIZF?) 
L AST(L INDEX] «MEMORY ADDP := BASE ADDRESS 
DO FOR ALL DBR'S 
IF IAST[I_INDEY]. in -NO/ACCESS AUTE €» ? ANTIF 
MMU IMAGE[DBR #].SDR[SEG #] .ATTRIBUTES=IN LOCAL TEEN 
MMU I MAGE[DER ei SDÁLSEG s]. RASE ADDR:=FASEZ ADDRESS 
FI 
OD 
SWECESS CODE := VALID 
END MOVE TO LOCAL 


Figure 25. Move To Local Pseudo-code. 





MPDATE PROCEDURE? (L INDEX WORD, GLOFAL_ATIR WORT, 
SIZE WORD) 
RETURNS (SUCCESS CCDE BYTE) 
ENTRY 
PO FOR ALL DBRS 
fet EAS Pitan INDFX]. SEGMTNT NO/ACCESS AUTE <> € ANTDIF 
MMIT IMAGE [DER £].SDE[SEC E ATTRIEUTES=IN TCCAL TEEN 
MMJ IMAGE(D38 4].SDR[SEG &].BASE ADDR := 
CLOEAL A 
FI 
OD 
BERS :- SIZm / BLK SIZE 
Ki E_IOCAL BIT_MAD (MZMOET_ADD2,FIKS) 
AST[L INDEX] .MEMORY ADDP := ACTIVE 
Bois: COLD c= VALID 
END UPDATE 


nunc update Psepdo-code. 


o 
OD 





NE ae he new elobdl address for the segment, and the 


size of the segment. The return parameter is a success cede. 


~ 


In this chapter the detailed design of the memory 
manager process has teen presented. The purpose of the 
memory manager was outlined, followed by a detailed 
discussion of the memory manager” s data bases. The design 
mented nas identified ten basic functions for the memory 
manager. The implementation details of these functions are 
Ben red in Appendix A. The success codes returned ty the 
memory manager are preserted in fieure 27. 

This design has assumed thet the kernel level 
inter-process synckronization primitives will be Saltzer’s 
ewes and wait primitives[15). This fact dominated the 
Hessen decision to lock the C AST in th user's process 
Breit signals the memory manager. In a multi-processor 
environment, the possibility of a deadly embrace exists if 
the memory manager processes locx the G AST. Shculd follow 
en work implerent eventcounts and sequencers as kernel level 
MemenroOnizatioOn primitives, the locking of the G AST an 


memory manager synchronization will need to te reeadcressec. 
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ANS TEM WIDE 


INVALID 
SWAPPED_IN 
SWAPPED OUT 

SEG ACTIVATED 

SEG DEACTIVATED 
SEG CPEATED 

SEG DELETED 
VIRTUAL CORE FULL 
DUPLICATE ENTRY 
RZAD ERROR 

WPITE ERROP 

DRIVE NOT READY 


MEMORY MANAGER LOCAL 


VALID 
INVALID 

FOUND 

NOT FOUND 

IN LOCAL MEMORY 


NOT IN LOCAL MEMORY 


! + DISK ERRORS 


kieure 27: 


KERNEL LOCAL 


LEAF SEGMENT EXISTS 
NO_LEAF EXISTS 
ALIAS DOES NOT EXIST 
NO CETID TO DELETE 

G AST FULL 

L AST FULI 

LOCAL MEMORY FULL 
GLOBAL MEMORY FULL 
SECONDARY STORAGE FULI 


Success Codes 
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u T POP Ss ARCE 


A. CONCLUSTONS 


The memory ménager cesign utilized state of the art 
software techniques and hardware devices. The design was 
developed based vpon ZILCG S ZECL1 sixteen bit segmented 
meperoprocessor used in conjunction with the ZEEIE Memory 
Management e a À microrrocessor which supports 
meementation is required to provice access control of the 
Stored data. The actual implementation of the Selected 
thread was conducted upon the 222972 non-segrented 
mmeroprcecessor without the ZECIL “MU. 

wow le information SE CUY Fequilres that the 
microprocessor support segmentation, the memory manager was 
developed to be configuration independent. Tre desier will 
Support a multi-processor environmert, and can be easily 
implemented upon any microprocessor or secondary storare 
Mica. The loop free modular design facilitates ánv 
required expansion or modification. 

Global (S OIT (n Ons minimized by the memory 
En eer. Segments are stored in global memory only if they 
are Shared and writable. Secondary storage is accessed only 
if the segment does not currently reside in global memory or 


seme local memory. The controlled sharing of segments 


Jol 





EUN mizes nain memory vsage. 

The storaze of the alias tables in secondary storage 
ports the recreation of user file hierarchies follcwire a 
system crash. The aliasing scheme used to address segments 
supports system security by rot allowing the segment’s 
Er location or unique identification to leave the memory 
manager. 

The design of the distributed kernel was clarified by 
assigning the MMU image management to the memory manager. 
Tre transfer of responsibility for memory allocation and 
jJ location from the supervisor to the memory manager 
provides support for dynamic memory management. 

Rn conclusion, the memory manager process will securely 
manage segments in a multi-processor environment. Tre 
ENS ess is efficient, and às configuration independent. The 
primitives provided by the memory manager will support the 
construction of any desired Supervisor/user process built 


moon the kernel. 


Eee FOLLOW ON WORK 


^ 


There are several possible areas in the SASS design that 
can te looked into for continued research. The complete 
implementation of the memory manager design (refine and 
Eumizs the current FLZ/SIS code) is ore possibility. Other 


Meese biiities include the implementation of dynamic memory 
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management, and modifying the interface of tne memory 
Meñaser with the distributed kernel using eventcounts an 
B eucers for inter-process communication. 

The implementatior of the supervisor has not been 
addressed to dices Areas of pescarci include) the 
implmentation of tre file manager and Pap ty Cb put 
processes, anc the complete desien and implementation of the 
Most pretocols. The implementation of the gatekeeper, 
system initielization are other possible reseerch areas. 
te mnic process creation and deletion, and the ¡introduction 


of multi-level hosts could also prove interestine. 


D 
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G ASTLINDEX] ALIAS TAELE_ Doni: 

ALIAS TABLE.ALTAS ENTRY [ENTRY_N0] .ALIAS_TAB1Z_LOC 


C AST[INDZXj.INSTANCEi :2 Q 

G AST INTTY]. INS E c= £ 

E EST [INDEX] .SECU i CON EM 

I := € 

I OO». T) 
INNO OSSDEODESSORS THEN 

OR 

FI 
EE EE SESCH EE := NTII 
E += 1 

Op 


EE ee IS eye sese olestie ole aie soe xo NOR Xe dod O Bak NS de de e ale de le de e de HE Bye Me OS SS TS IE 
x ste 
Te MATE LAST ENTRY Procedure is called from the = 
^ activate procedure. The procedure will obtain an e 
É index into the L AST and enter the appropriate Gata. as 
é mesenemar, adap field is set to active, the seenent_ > 
D #faccess autn fields are initialized to zero, and i 
E the passed Segment number is entered inte the ap- $ 
Eis Beosriete location. If the entry is successfully i 
ade, a success code of valid is returned. E 
ze x: 
A hey estet sue se seated 


MERS L AST ENTRY PROCEDURE (LER NO BYTE, SECM 
RETURNS ( SUCCESS CODE FYTE, L_INISZ WORD ` 
DOCAL I PYTE 
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EE V 


Sat NO WORD 
ENTRI D 
IOS E SGS COLS. L INPST 


= LAST INDEX 
£m SIC m SS REO mE ESO SCH 


EDS OR ADER 2= ACTIVE 


L_AST[L INDZX].SFGMENT_NO_ACCESS_AUTE[I] := Q 
I[ += 1 
IF I >= MAX DBR NO THEN EXIT 


KZ I AST FNTE 


IST[I INDEX] .SEGMINT_NO_ ACCESS P“>UTELDBR_ NO) :=SEG “ENT 
KE RY 


a MRE DERCOIVATE ALL Procecure is called ty the 

» Detete entry procedure ard by the "ain line 

E procedure. The procedure will deactivate the 

* deleted segment from all connected process’ 

4 address Space. The G_AST index and the I_AST 

i meer ior the deleted s€gment ere passed to the 

E procedure. I? the segment was successfully 

= deactivated from all connected processes, a 

E success code of valid is returned. 

A ele e ie e ee ele gie gie e ie ae O 


DIA 


SND 


SES VATES ATI  PECCEDURZ ( IN 
RETUSNS ( SUCCESS COTE E 
ECL I -FYTF 
ENTRY 

I := 
LO 


EE WE EEN EE EISE j 
ndo 


e 
IF I = MAX DEP NC TER WELT 

p 

IT I AST[L INPEX].SEGMENT NO ACCESS AUTF[TI] 
<> Z$70 TEEN 
J I Kpa ) 


SUCCESS CODE [ 
BACTIVATEL THEN 


IF SUCCESS CODE < 
RETURN 


N 3 
Et 
TA T 
= 


FI 
j 


+= 1 


— t | 


OD 
SUCCESS CODE ze VALID 
DEACTIVATE ALL 





Í MERINO TES ENE NOR MANAGER Procedure is called > 
F Ra procedure, The »rocecurs will sigral E 
st a memory manager to move a Segment from its local j 
* memory to global memory. When the segmert is moved se 
E to global memory the procedure will signal all cther e 
2 connected memory manegers to update tneir local dE 
"I databases. The global address for the transfer = 
* passed. A success code is returned to indicate E 
i o CCE e of the operation. ^ 
AO E NE IAE EE NL NEL AR AS RNE NE E E TETERA AN NE TEAS SSRIS Sie SEE TS SSS 
SIGNAL OTHER MEMORY MANAGZ PROCEDURE ( 
So INDEX T" ADDR WORD ) 
BERWENS ( SUCCESS CODE PT |) 
LOCAT 
EROCESSOR NG e 
Ir q BYTF 
L_ENT27 NO WORD 
VALID MSG no 
Me ARRAY [MAX MSC SIZE PYTE) 
ENTRY 
Denn «= TRUE 
PROCESSOR NO <= C 
DO 
E oS On nO = PROCESSOR ID THEN 
PLO SSOr ONG += 1 
FI 
IF PROCESSOR NO NOSE OC SOS TEEN 
ENIT 
FI 
IAN C AT Sae INDEC]. PROCESSOR I ASTE NO[ 
PROCESSO: Ta] 


te abe ate ate ate ate ale ate als ale ale ate x: ale alo slo «lo als ses dE Sie sl . slo se. to ate ate ate ate nto alo ale sie 
Zus gun Zug ug 0,* Far Oye oye - 


I? LI ENTRY NO <> NULL fT 
IF FIRST = TRUE TER 
FIRST := FALSE 
IF PROCESSOR NO 
CASE £  TEZN 
SIGNAL ( VP ID, MEMOR 
L RE "ADDR, GA 


VP. IS Gai WAIT 


MANAGZR_@, MOV 
Rec RIN DEI 


“Y 
à 
m 
SUE 


MSG S ee ! 
VALIDATE WAIT MESSAGE {MSG} 


le CEECK IF VALID 
VALIT MSG := 


je di 
ETS? 
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POCE SCR NO 
Ç THEN 


SICNAL( VP ID, 


Cate 
E» ref 
A Ca 
tj 


MEMORY MANACER C, 


DOR, 


D—ENTPY NO, ADDR. € adiu eco INTER]. omer + 
IS t= quim 
AGNOS GE SM” IF MANO MSG Heus. 
VALID MSG := VALIDATE WAIT MESSAGE(MSC) 
Sc 
F 1 
FI 
PROCESSOR NO += 1 
OD 
IDAS E TEEN 
SUS o COLE := VALID 
FLS 
SESS CORE <= INVALID 
FI 
AMS ICNAL OTFER2 MEMORY MANAGERS 
pa E DIT usc M ces see cer EE E EE se ses ses cao Nae See Suk e ie e Se ge 
* The CEFATE_ENTEY Procedure is called by the > 
E Main line procedure. The procedure will create Bs 
EE entry irto the alias table and allocate sec- 2 
m ondary storage for the created seement. lf tre = 
ze alias table Goes rot exist, the procedure will iu 
x create az alias table on Secondary Storaze. B 
= A unique id is assigned to the segment and the > 
> appropriate data is entered into the table. = 
ge ace unetion is successfully completed. a x: 
E A) cess code of segment_ created is returned. D 
A Eelere ee ae ale E de Re le le ee ele oy d 
MATT INTZY FROCELUSE ( PAR INDEX wOaD, SNTRY_NO WORT, 
ee eee ee CASS Lr 2Ymw .) 
EEDERNS X STECHSS COLE EYTE |) 


PAGE TAFIE 
Ek AG 


LOC 
WORD 


LOCAL 


ENT! 
BS := SIZE / RIE SIZ? 
IF G_AST[FAR_INTEX].C_ASTE_NO_FAR <> ZERO TEEN 
SICOTSS_COLF := CREATE AIAIS TABRLE( 
IF SUCCESS CODE <> VALID TES! 
RETURN ^ 
FI 


= 


PAR Tine 


2) 


u 





n 
SUCCESS CODE := FEAD ALIAS TI 
COSA INDEX]. ALIAS 
IF srccÊSS COLE <> VALID TEZR 
RETURN 


ALIAS TAELE.ALIAS ENTRY(ENTRY NO].UNICUID ID 45 € 
EN 
SMCCHSS CODE := DUPLICATE ENTRY 


POM IN 


+3 + ta 
CH tj r4 


RTI 
HE SUeCs5s CO T CU fe ror Cp 
SER 
css: CODA <> VALID THEN 
RETURN 


FI 

IAS MPA BLE.ALIAS. SE e NTRY NO] .UNIGUE_IT, 
MOSS CODE (= CET UNIO ID 

ee coeds. CORE <> VALID TEEN 

STURN 

PI 

SA ASENTAR [ENTRI _ NO] .S1IZZ := SI 

ALIAS _ TABLE, ALIAS ENTRY {ENTRY -NO]. CTASS <= C 

AITAS gramm: RATEN DEN ZF Nm ay, E PAGE s 

s —TAFT 


— 


Z 
E 
jt 


As 
r9 
“10 


Ca can 
il 


I GC NO} ALTA ETE LOC :- 


SUCCESS CODE := WRITE ALIAS TAELE(G "arts INRI]. 
ALIAS TABLE LOC, ALIAS TATIE ) 
iF SUCCESS CODE = VALID TEEN 
Sue CODE >= SEC CREATED 
FI 
CREATE ENTRY 


ieee ote eee NTRY Procedure is called by the Yain- 
line procedure. The procedure will rerove a segment 
from secondary storage by deleting its entry in its 
mentor seement’s alias table and deallocating its 
allotted secondary storage. Fefore the seement is 
deleted, the G AST is checked to ensure that no other 
process holds the segment active. and that the serrent 
Le not a mentor segment. if the segment is e mertor 
Sesment, deletion is not allowed. If the segmert is 
active, those processes will be Sienaled to deactivate 
the procedure. Wnen the segment is deactivated, it 
will be deleted. If the deletion is successful, a 

EU essacotecof ses deleted will be returned. 
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K Sma ENTRY PROCEDURE ( PAR INT 
RETURNS ( SUCCESS COLE BYTE ) 
LOCAL I_ INDEX WORD 

MBE WORT 


I BYTE 
ALIAS TABLE EMPTY BITE 
OTEEPS ACTIVE EYTE 


ENTRY 


ME AGT {EAR INDEX] .ALIAS TABLE LOC1 <> NOLL 
SCD += READ APATS TAPEn ( G AST[EAR 


Yo ale alte ate ale alo ale ats ate al ' 
Je de «de alo nds alo «te als als nto nho als nto uia ate ate ale als ales ale ale de ade ata ale ale ale alte ale ale ale ale als als als de a's ale ole 
t x ^ e es 2 ey dr dr gt ous gu ds atb IA IA IA O ER AA IIA IA IA IIA INIA Su SS d cs Ss > RADA ` 


ENTRY NC 


een 
TAD] 


AIIAS TABLE LOCIE FALTAS ` TAZ E) 


ES E 
MS SOL. := NOT CEHILP TO DELETE 
T 
Ú CSST CODE <> VALID TEEN 
RETIPN 
ET 


ro 
txj 


ALIAS_TARLE_PMPTY := CEECX_1F_ 
IF ATIAS TABLF_ EMPTY = TRUE TEEN 


IR LSB ODER iio. :— SsAROM G AST 


ALIAS sMP' 


de a's al 
tá 


WOFD 


ALIAS TAELE.ALIAS SNTRY(ENTRY NO} .UNICTE_ID 


IF SIHCCFES o. = FOUND "TEEN 
L INDEX := TÍPAR INDZX].P20C 
en] 
IF I INDEX €^ NULL THEN 


SUCCESS CODE :- DEACTIVATE ALI(INDEX, I INDZXI) 
IF SUCCESS CODE <> VALID TEEN 


RETURN 
FI 
T 
OTFZRS ACTIYF :- CEZ 
NONU ACTIVE = 
SIGNAL OTRERS TO. 
FI 


CK 
TRIE THAN 
DE 


DELETE Sic ( ENTRY E ) 


TACTIVATE A 


- de 


Mio ACTIVA 


ALIAS TABIZ.ALIAS SNTATI[SNTRI NO].UNICUEX IT 


SUCCESS CODs := TIE ALIAS TABLE 


A EOL 


IF SYCCESS CODE = VALID THEN 
SUCCESS CODE := SEG DELETED 


“SUCCESS CODE ze DEPENDENTS EXIST 
EN 


END LELET? ENTRY 
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SSOPS I ASTE 


BEN 


C 


ale y 
"^ 
. 


` 
I 


) 


( G ASTÍPAR INDTX]. 
DUE USATI 
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E Du gU PPOCcecGure je called by the Main line js 
= procedure. The purpose of activate is te add a i 
e Segment to the user’s address space. The procedure "s 
= is passed the segment_#, the parent “s handle, and 
i the entry number into the alias table for the 
D Segment. The procedure returns the size, > 
ag class., and the handle for the activated segment 
>€ The G_AST is searched to determine if the segrert E 
* is already active. If the segment is active and a 
B min ne PAST. en entry 1s mede in the L_AST * 
E and the G_AST is updated. If the segmert is active = 
pe in both the G_AST and the L_AST, the entries are d 
P updated. If the segment was not active, entries i 
E medie Im bota the GAST and the I AST, d 
ds If the operation was Successfully completed, a s 
* success code of seg activated is returned. E 
BAR NE ES DIS DM DJS DI NOS DIR DIS E nd IN! 
ACTIVATE — PROCEDURE (D?? NO BYTE, PAR_INDEX WORT, 
ENTRY NO SNORT, SEGMENT NO YT? ` 
Peirce t SIiCCeSS COPE EYPE , G AST HANTIE FANTIE . 
OE urs SIZE EOS Y 


ILOCAL IL INDEX WORD 


INIST WORT 
ENTRY 
PTC AST[PAR INDEX] .AaLIAS TAPRIE 1001 <> ZERO TEEN 
Nu EE TAELE(G EST[PAR INTER]. 
SD PAL IAS TAELE } 
TLSF 
SUCCESS COME := NO PEAP TXIST 
FI 
MN NOUCSSS CODE <> VALID THEN 
FUTMRN 
FI 
SCORE, INDEX t= SSAPCE CAST ( 
EE Ee NOV SUNICUT IT 
IF SUCCESS CODE = FOUND THEN 
ie OENSTUSNDERIEROOGESSORS L AST? NOI 
PROCESSOR II] 


C 
IP IL INDEX <> NULL ‘EEN 
1 AST(L INDEX] .SEGMENT NO ACCESS AUTE 
MENT 


ELSE 
SUCCESS CODE, L INDEX :- MA 


mu Ss CODA <> VALID 
ASTURN 
Br 





"ND ACTIVAT? 

See a j A Sg 

15 ate s aoe xx Jen ato als ES = we de me nn >< ate ste se ste ale x se so este sie ars ale ale ste se ste estes esta ate ale ale = ale whe af = ste ato ales ate ale vie ale a's i e alo s 2ye te te 
EE 


ale 
eu 


D 
2 


EE OFS 1 -ASTE NO[PFOCESSOR 
= f= SbeINDSs 

FI 

J EEN Kee EES _TAFIS LOC} IAN 
c ASTÍPAR INDZX].NO "DEPENDENTO ACTIVE == 

F 

EN 

SUCCESS COLE, INDEX :2 MAÉE G AST ENTRY(?TNTEY 

NONEM CCXSSECGDE S GCNST FULL TEEN 
RETURN 

"I 

SEO IU SX “MARE LAST ENTSZY ( 

PAR INDEX, ENTRY NO O 
E SS cons = LAST FULI Tan! 


EIA EE L ASTR NO[PROCECSOR IT 


I INDEX 


eoe CORR Su ACTIVATED 
SIZE := ALIAS TABLE. ALIAS ENTPY[EZN?3Y NO].SIZE 
CLASS := ALIAS TAELZ.ALIAS ENT CY[ENTRY NOJ.CIASS 


G AST RANDIE.UNIOUS ID2 :-G AST[INDEX].UNICUE ID1 


C AST FANDLE.INTEX :- INDII 


Res OUT Procedure is called bv the Main line 
procedure or the Pleactivate procedure. Tre 
procedure will remove à segment from main memory 


dg ERR stora it on secondary storaze, Tre procedure 

” is passed the process” DIR_% and the G_AST index 

S for the segment to be swepped out of memory. 

a A success cofe is returned to indicate tne success 
i: of the operation. The procedure reroves the 

5 K ri from thelprocess' “MU_Imaze and if not 

* shared, it is returned to secondary storage 

E and memory deallocated. Shared seements remain in 

= memory until ail processes have swapped the segment 
K out of main memory, 

A O O o o o KE BIS 


SWAP OUT PROCEDURE ( DER_NO BYTE, INDEX WORD | 


mcURNS ( SUCCESS CODY EYTE ) 
LOCAL RIKS WORD 

L INDEX WORD 

SEO NO WORD 
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ENTRY 
emas CRUST [IN DON]. simil / BIZ SIZE 
IND: =C HAS TL IND EX]. PROCESSOR L ASTE NO[PROCZSSOR ID] 
SB. io merce ON INDET] . SEGMENT NO ACCESS AUTE(DEP NO] 
F»*E PPOCEZSS VIRTUAL CORE ( BLES ) 
DEZIET2 MMU ENTRY ( DEP NO, SEC NO ) 
G AST[INPSX].NO ACTIVE IN MEMORY -- 1 
IF (MMT IMAGE [DER NO] .SDRÍSEG NO] .ATTRIRUTES AND 
WRITTEN MASK) <> £ TEEN 
G ASTIINDEX].FIAG BITS :- G AST[INDEX].FIAC PITS OP 
WRITTEN MASE 


I 
EAS PINEDO]. CLOBAL ADDR = NULL TFEN 
IF e Sm MINDE NO ACTIVE IN MEMORY = Z ANTIF 
(G_AST[IND male FLAG BITS AND WRITTEN MASK} <> g 
TEEN 
SUCCESS 0008 := WRITE SEGMENT ( G AST[INPEXI. 
E ELO. 1 Benito INDEX]. 
MEMORY_ADDR ) 
IF SUCCESS CODE <> VALID THEN 
RETURN ` 
FI 
O ALTE MAD TAS TIL INDEX].MEMOEY ADDE, 


RIKE ) 


 AST[INDEX].NO, ACTIVZ IN MZMOPY 2 ? TETN 
HMENMESOUNMEGEDTOSAEAMUUISASTIL INDEX]. 
MEMORY ADDR, FIKS ) 


FI 
ELSE 
IF G_AST[INDEZ).NO_ACTIVE_IN_MEMORY = € ANDIF 
(G_AST[INDEX] .FLAG BITS AND WRITTEN MASK) <> @ TFEN 
SIME OIM - WRITMOSHCMENT (1G AST[INP*X]. 
EALE LOCI, G NSTIINDEX].GIOSALI ADIR } 
NEUES Ss ¿CODE <> VALID TEEN 
RETURN 
FI 
FREE GICEAL BIT MAP ( G AST[INDSX].GIOEAL ADDR, 
EIXS \ 
ISE 
IF G AST[INDEX].NO ACTIVE IN MEMORY = E THEN 
FREE GLOBAL BIT MAP! G_AST[INDEX] .CIOPAL_ADPR, 
RLZS ) 


tz) 


FI 
SUCCESS CODE := SWAPPED OUT 
END SWAP OUT 
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The DEACTIVATE Procedure is called by the 

the Main line procedure, the Deactivate_all 

mes N eOr e Delete entry procedure. 

The purpose of ‚geactivate is to remove a segment 
from a process” address space. The segmert is 
removed by deletine the segment number from the 
I [UI í norotner processes Pave the segment 
active and no children are active, the entry 

is removed from DE M and ne G ist. 

The process” DBR_# and the deactivated segment’s 
G ASST index are passed to the procedure. A 
weee eode 15 returned to indicate the success 
of the overation. 
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IVATE PROCEDURE ( DBR NO BYTE, INDEX WORD ) 
TURNS ( SUCCESS_CODE EYTE } 
CAL L_INDEX WORD 
SEG NO Par 
CEECK BYTE 
PAR INDEX WORD 
TRY 


PAR INDEX := G_AST[INDEX].G_ASTE_NO_PAR 


L 
SEG 
IF 


BI 


INDEX 
G_NO LASTÍL. INDEX] .SECMENT NO ACCESS _AUTE (DB 
“G AST[INDEX].NO ACTIVE IN MEVORT <> Z THEN 


- G AST(INPZX].PROCESSOR L ASTE NO[PROCE 3 OR IDj 
j 


fr (PU ` IMAGE (DEP Kol: SDR [S SzG NO] .ATTRIBUTZS AND 


IN MEMORY MAS E) = ZERO. TEE 
i p O CODA S= SWAP CUT ( DER NO, INISX ! 
IF SUCCESS CODE <> SWAPPED OUT THEN 
RETURN 
FI 
Dn 


AST[L INDPEX].SEGMENT NO ACCESS AUTE[DER NO] :- £ 


mares &COTIVE IN L AST( L.INDEX ) 
IF CEECK 2 Q TEEN 


E 
I 


FI 


L-AST[DL INDEX] .MEMORY ADIR := AVAILABLE 


I 
F PAR INDEX <> @ TEEN 


C AST[PAR INDEX].NO ACTIVE DEPENDENTS -- 1 
CHECE FOR REMOVAI ( PAR INLEX ) 


ECK FOR REMOVAL ( INDEX ) 
ENISEXSS CODE := SEG DEACTIVATED 
END DEACTIVATE 


lo: 
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YOR AE EE 
se = 
E The MOVE TO GIOEPAL Procedure is called by t^e E 
x Main line procedure. The procedure is called to = 
E to move a shared and writable segment to glotal x 
P memory. The procedure is passed tne I AST incer, e 
D the size, and the global address for the move. = 
> À success code is returned to indicate the E 
4 success of the operation. The procedure locates 7 
E the segment in its local memory, transfers the * 
D segment to global memory, and deallocates the x: 
ae local memory. Ze 
EE El e EE EE NER NC AEN OO e E Ee E e e die ie die gie die ge ze dee de ice tete dc ek zie g 


MOVE_TO GLOBAL PROCETURE ( L INDSX WORD, GLOFAL_ATDE 


ADDRESS, SIZE WORD ) 
RETURNS ( SUCCESS CODE PITE ) 
LOCAL SEG NO  PYTE 
I BYTE 
ENTRY 
MEMORY MOVE ( L_AST[L_INDEX] .MEMORY_ADD3, GLOF: 
ES 


L AST[L INDEX].MEM4ORY ADDR := ACTIVE 
I := £ 
DO 
IF I = MAK DER NO THEN EXIT 
FI 
SEG NO ze L ASTÍL INDEX].SEGMENT NO ACCESS AUTF[I] 
PDR ELE 
NO ANDE (MU IMAGE[I].SDR[S 
ATTRIBUTES AND IN MEMORY MASK) = 
MMU IMAGE[I].SDR[SEG NO].PASE ADDS := C 
i 
+= j 


mi tr 


0D 

ES MIOUALORPTSMAPCUOECAST[LINLEX].MEMORY ADLR, ELKS | 
SNCOESS CODE := VALID 

MOV TO GLOBAL 
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fisse zx. sc 2. 2, ^92 a ZAR AR AST 2 DES TIS DIV DNS TIS DJS tat Tam am tay IS mS IRIS IIR ART on Eva i25, 
E The SWAP_IN Procedure is called ty the Main line z 
E procedure. The procedure will transfer & segment st 
> from secondary storage to main memory. Tne procedure S 
x is passed the process” DER &, the segment s G_AST zi 
^ index, and the authorized access to tane segment. = 
* A Success code is returned to indicate the S 
Re Eu@ecess of thesoperation. ( successful - swappec in ) * 
É I° the segment is not already in memory, tre appro- s 
je priate memory is allocated and the Seement iS trars- u 
> fered to the allocated memory. If the segment is a 
> writable and shared, the segment is transfered into > 
E global memory. v 
x at 
een ae ste ee e taste ote SiS ERO NS DIRAIS IOS SOR DEOR Bg Bye Bye Be DIO SIDA DR ONO Ar ste se sto oeste ete oe ott ! 
SWAP IN PROCETURZ(INDFEX WORL,DBR NO BITE,ACCESS_AUTE FITE) 
RETURNS ( SUCCESS CODE EYTS ) 


LOCAL BIKS WORD, 
TEST PITE 
SEG NO BYTE 
I_INDEX WORD 
EASR_ADIR ADDRESS 


ENTRY 
peces C AST[INDEX].SIZZS / BLK SIZE 
L_INDEX:=G_AST[IND um PROCESSOR” Pe oleae NE RoCasSSOn 1m! 
ERC NO :- I _AST(L_INDAY].S GMENT NO ACCESS AUTE(DZP NO] 
EBIECSSS COPS := CFECK MAX "YI RTUAL CORE ( DER_NO, BIAS ; 
IF SUCCESS COTE = VIRTUAL CORE FULL TEEN 

RETURN 
FI 
Gero FINDS X}).NO_ACTIVS_IN MEMORY += 1 
IF ACCESS AUTE - WRITE THEN 

SS e E ASTIINDOX!.ZLAG EITS OR 

TS 

FI 
E (G_ASTLINDEX] .FLAG BITS AND WRITABLE MASK) - € 
OFIF G_AST[INDEX] .NO_ACTIVE_IN MPMOPT (21 TEEN 

a a CHEOKR LOCAL MEMORIY „| I_INDSX ) 

IF TEST <> IN_ LOCAL MEMORI TEEN 
SUCCESS TOOL D ADDR := ALIOC LOCAL MEMORY(FIES) 
IF SUCCESS CODE = LOCAL MEMORY FULL TEEN 
RETURN 
Gë 
SUCCESS CODE := READ_SEGMENT ( G AST[INLFX]. 


PAGE TABLE LOC1, ELSE ADDR ) 
<> VALID TEEN 
idt 


SUCESO 
I MAP ( BASE ADDR, PIES ) 


FREE LOCAL. 
RETURN 


Tues 
5 


SS 
a 





L AST{L_INDFX] .MEMORY_ADIR := FASF_ATTF 
ZISE 
BAS? ADDR := L_AST[L_INDEZ].MEMORY_ADDR 
FI 
ELSE 
IF G AST[INDEX] .GLOBAL_ADDR = NULL THEN 
STCCESS CODE, FASE ADDR ze ALLOC GLOFAL MEMOBT( 
EIXS ) 
IF SUCCESS CODE = GIOBAL MEMORY FULL TETN 


RETURN 


I 
F TEST = IN LOCAL THEN 
EE = MOTERO CLOPAL ( L INDEX, 
SDE Gens NTN hek |. Sized * 


IE Gos COD <O VALID TEEN 
FREE GIÓFAL BIT MAD ( BASE_ADTR, ILES ! 
RETUPN 
FI 
TISE 


SUCCESS_CODE := 
SIGNAL OTHER MEMORY _MANAGE2S (INDEX,EASE ADDR) 
IF SUCCESS COLE <> VALID TEEN 
RETURN 
FI 
FI 
ELSE 


PASE ADDR zs G_ASTÍ[INDEX].CLORAL_ADDR 
FI 


a 
Damir IMACE(DES NO, SEG NO, BASE ADLR, ACCESS AUTE, 
I 


MED LAST AGCESS ( L INDEX, AGCESS AUTE, DER NO ). 
SUCCESS CODE := SWAPPED IN 
END SWAP_IN 


! AA UN 
D MENO LOCA Procedure is called by Lhe Mein. | 
£ line procedure. The procedure is called when ' 
P a Segment no longer needs to be in global merory > 
€ and can be moved to local memory. The procedvre = 


Mee passea tne L AST index, size, and global acdress 
ENS scoembnt to Le movec. À success Code is returned 
to indicate the success of the operation. 
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ye eye em °” > - +» ee o... e Ld hd eya Zum y Zus du d ^. ~~» eya or = my oye oe eu e e Ls hd ue. ee .. oy e" ^ e, Zus Zus s “je Zus Zus dun “ye e. ee Sum ee vam o ou. T 
. 


MOVE TO LOCAL  PROCEDUPE ( L INDEX WORD, GIOZALi ALDIR 
Za WO | 
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TENSO CES S COD 2713 ) 
LOCAL FASE ADDRSSS ADD2TSS 
src NO FYTF 

I RYTE 
ELKS LY 
ENT?Y 


BIRse2 22178 / DLE SIZE 
SUGUESS CODE, DASS ADERESS 


É EEG S. 
Mec ec’ss COLE <> VALID THEN 


RETURN 

FI 

MEMORY MOVE ( GLOFAL ADDR, EAST ADDRESS, SIZE | 
AS DL. INDEX] .MEMORT ALDR := ZASE ADDRESS 

I := Ç 

Ife 


SEC NO :- I AST(L INDZX].SECMENT NO ACCESS AUTP[I] 
E 


IF SEG_NO <> £ ANDIF (MMU_IMAGI[TI].SDRÍSEG_NO]. 
ATTRIBUTES AND IN MEMORY MASK) = € TEEN 
bt IMAGE[I].SDRLSEC VOT.BASz ADDRI=BASE ADDOTSS 
FI 
I += 1 
OD 
SUCCESS CODs = VALID 
END MOVE TC LOCAL 
(E EE EN 
ES MED EDATE Procedure is called tw the Main line a 
E Broce2ure, The procedure is called to update tre B 
r MMU images of process” connected to a Sesment 
= that was moved to global memory by the Move to alotal * 
E procedure. Tre procedure is pad Ene cT index, e 
x Mme size, and the global address of the segment i 
= that was moved to global address. A success code Se 
| is returned to indicate the success of the operation. * 
EE UNG en 3S 345 8 A EE EE EE A NESE ETS YEE TSF 


UPDATE PROCEDURE ( L INDEX Y SÉ 


ry 
me. 
La 
td 
un 


RETURNS ( SUCCESS CO 
FOCAL SEG_NO Eye 
BIKES BYTE 
T BITE 


[1j tJ 
ej 
Di 
wel O 
E 
taj 


tH by 
= 
ee + 
Word 
— 
FS 
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DO 


IF I 
FI 
SEG NO :- L AST[L INDEX].SEGMENT NC ACCESS AUTE[I] 


= MAX DER NO TEEN ENIT 


AND E EE 
CRC ANDO? (mm IMAGE [TI]. STRÍSEG_ NC]. 
TPIBUTES AND IN MSMORY MASK) = 2 TEEN 


MMU IMAGE(IJ. SUME NO! . BASE ADDR ze GLOBAL ATDR 


BE S 
AT 
FI 
I += 
OD 
PLKS := 


i 


pie, oe ZE 


PIER LOCAL BIT MAP( L_AST([L_INDEX] .MEMORY_ADIF, BLES ) 


ies Tal lL INDEX] .MEMORY ADDR = ACTIVE 


BENGOXNSS CODE := VA IT 
END JPDATE 


4 


ls 1 lo nbe a 
sedes se MAIN LINE COD» E 


SSECTION MAIN 


MAIN LINE PROCEDURE 
MODAL FUNCTION Ets 
ARGUMENTS ARRAY [ = BYTE] 
MSG ARRAY [MAX MSG SIZE BYTE] 
VP ID FYTF 
SeS CODE LTT: 
ENTRY 
INITIALIZZ PROCESSOR LOCAL VARIAFLES 
DO 
CESCK MSC CUEUE 
VP ID, MSG := WAIT 
To seek VALIDATE THE MSG FROM WAIT ms | 
FUNCTION, ARGUMENTS := VALIDATE “SG ( MSC) 
IF FUNCTION 
CASE CREATE ENTRY THEN SUCCESS CODZ :- 
CREATE ENTRY(ARCUMENTS) 
CASE DELETE ENTRY THEN SUCCESS CODE :- 
DELETE ENTRY(ARGUMENTS) 
CASS ACTIVATS THIN SUCCESS CODE,HANDLE,CIASS,SIZE 
ACTIVATE (ARGUMENTS \ 
CASE DEACTIVATE THEN SUCCESS CODE := 
DEACTIVATS (ARGUMENTS ) 
CASE SWAP_IN THEN SUCCESS CODE := 
SWAP IN(ARGUMENTS } 
CASE SWAP_OUT THEN SUCCESS COLE := 


SWAP OUT(ARGUMENTS) 





G ss TO LOCAL THIN SUCCESS COD := 
ps MOVE TO LOCAL( ARGUMENTS 
Soe eve etOnChOrAL TEEN SUCCESS CODE := 
MOVE TO GLOBAL( ARGUMENTS } 
CASE UPDATE E NES GS SC ODE += 
UPDATE( ARGUMENTS ) 
CASE DEACTIVAE ALL THEN SUCCESS CODE := 
DEACTIVATE ALL( ARGUMENTS | 


Ca. A 


FI 
SIGNAI ( VP ID, SUCCESS _COD®, AEGIMENTS ) 


END MAIN LINZ 
END MEMORY MANAGER PLZ SYS MODULE 


ES 





APPENDIX B -— PLZ/ASM SOURCE LISTINGS 


J Ae a a he at a a ote ote zt xi te dc oie ote ot a a he ak ae ale a ae Sasa eae a fe RCS toe ote tete soot e ae e teo aie a aK oe aie ak ak as ak ak | 
! THE PLZ/ASM MODULE WAS WRITTEN TO PROVIDE SUPPORT FOR ! 
! THE SWAP_IN TEREAD [APPENDIX 3]. THE VALIDITY OF THE ! 
J CODE EAS NOT BEEN THOROUGHLY TESTED, NOR EAS IT BEEN ! 
! OPTIMIZED. THE CODE SIMULATES SECONDARY STORAGE IN ! 
! MAIN MEMORY, AND WAS NOT INTENDED TO BE USED IN AN ! 
! ! 


ACTUAL SYSTEM IMPLEMENTATION. 
ae ae oe at aa af ea ae ate de eae a ode ode tel xe let ae ide ile ai e eae Sa e state A a ee e 


M MGR 2 MODULE 


Dr ++ VERS, 1.0 * *w# | 


CONSTANT 
FALSE = @ 
TRUE = 1 
AVAILABLE = 4 | AST ENTRY AVAILABLE ! 
ACTIVE = 1 ! AST ENTRY ACTIVE ! 
ZERO = 2 
NULL = 10203 
NULL PAGE = ¢ 
EBUG = %4920 
MONITOR = %059A 

SUCCESS CODES | 

INVALID := Q 
VALID = 1 
FOUND = 2 
NOT_FOUND = 3 
SWAPPED_IN = 4 
SWAPPED OUT = 5 
SEG_ACTIVATED = 6 
SEG DEACTIVATED := 7 
SEG CREATED = 8 
SEG_DELETED = 9 
LEAF SEG EXISTS := 19 
NO LEAF EXISTS - 11 
C AT RULL = 12 
L_AST FULL = 13 
IN LOCAL MEMORY := 14 
NOT_IN_LOCAL_MEM := 15 
LOCAL MEMORY FULL:= 16 
GLOPAL MEM FULL := 17 
VIRTUAL CORE FULL:= 18 
DUPLICATE ENTRY := 19 
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NO CHILD TO DEL = 

SEC STOR FULL = 

DISK ERROR = 22 

ALIAS DOES NOT EXIST := 23 
! ATTRIBUTE MASKS ! 


READ_MASK E LO 

WRITE MASK = %(2) 29202901 

CHANGED MASK = %(2)31092002 

IN MEMORY MASK := %(2) 33000103 

CLEARED = I CLEAR ATTR! 
! AUTHORIZED ACCESS ! 

READ = 2 

WRITE = 1 

EXECUTE = 2(2)00021009 
! G AST FLAG BITS FIELD MASKS ! 

WRITAPLE_MASK := $(2)00€00210€ 

WRITTEN MASK s= %(2)90020100 
! DESIGN PARAMETERS ! 

BLK SIZE 128 

MAX PAGE SIZE E 


NO OF PROCESSORS 1 


l ou Wn ow Il 


MAX DER NO 4 | EVEN NC. OF DER es? 
G AST LIMIT 16 | MAX ENTRIES IN G_AST ! 
E AST LIMIT = 16 ! MAX ENTRIES IN L_AST ! 
MAX_ENTRY_NO : d EE EES 
NO SEG. DESC REG. :2 8. ! NO. OF SEGMENT/PROCESS! 
FST POSS FREE BLK:= 1 
DISK MEM BASE. = OLLE 
MAX POSS D BLES := 96 
GLOBAL MEM BASE  :- %8009 
MEXIPOSS G BLKS <= 32 
LOCAL MEM BASE = 2600900 
MAX POSS L_ BLES := 64 
DISK BIT MAP_LOC := Ø 
TYPE | 
ADDRESS WORD 
ALIAS EEADER RECORD [ 


SEG PAGE TABLE LOC WORD 
PAR ALIAS TABLE LOC WORD ] 


SEC DESC REC RECORD Í 
BASE ADDR ADDRESS 
LIMIT BYTE 
ATTRIPUTE BYTE ] 
ALIAS RECORD [ 
UNIQUE_ID WORD 
CLASS WORD 
SIZE WORD 
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GLOBAL 


PAGE TABLE LOC WORD 
ALIAS TABLS LOC WORD ] 


MMU RECORD ( 
SDR ARRAY [NO SEG DESC REG 
SEG DESC REG] 
BLKS USED WORD 
MAX ELKS WORD] 


ISSECTION G DATA |! 


GLOBAL MEM BIT MAP ARRAY [MAX POSS G BIKS/16 WORD] 
CST LOCA BYTE 


| SSECTION L DATA ! 


INTERNAL 


MMU IMAGE ARRAY [MAX DBR NO MMU] 
LOCAL MEM BIT MAP ARRAY [MAX POSS L BLKS/1€ WORD] 
ALIAS TABLE RECORD [ EEALER ALIAS _EEADER 


ALIAS_ENTRY ARRAY 
[MAX_ENTRY_NO ALIAS] ] 

DISK BIT MAP BUFF ARRAY [6 BYTE] 

PAGE TABLE BUFFER ARRAY [BLK_SIZE BYTE] 


COMPACT L PROCEDURE 


ENTRY 


END COMPACT L 


COMPACT C PROCEDURE 


ENTRY 


END COMPACT C 


GLOBAL 


ALLOC LOCAL MEMORY PROCEDURE 


! Boe cee ek ae Se hs ote Ds aye ode Se e ee e ee e dee de ee see see $ 


! PASSED PARAMETER 


' 


l 
! 
! 
! 
! 
! 
! 
! 


! 

R@ = BLES OF MEMORY ! 
RETURNED PARAMETERS ! 
R@ = SUCCESS CODE ! 
R1 = BASE ADDR ! 
LOCAL VARIABLES 
R@ = BLKS ! 
R10 - BIT MAP INDEX ! 
R11 = COUNTER FOR BIT ! 
R12 = BIT MAP WORD ! 
R13 = WORKING REGISTER 
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E OO | 


LOCAL 


ENTRY 


BLES WORD 
IS COMPACTED BYTE 
FILLER2 BYTE 


LD PLKS, RØ 
LD3 IS COMPACTED, #FALSE 
LD Rig, #ZERO 


DO 
CP 
IF 


FI 
LD 


DO 


R19, #(MAX_POSS_L_3BLKS/16) 
EQ THEN 
CPB IS COMPACTED, #FALSE 
IF EQ THEN 
CALL COMPACT L 
LD R10, “ZERO 
LD3 IS COMPACTED, *TRUE 
ELSE 
LD RG, #LOCAL MEMORY FULL 
RET 
FI 


R11, 4ZERO 
R12, LOCAL MEM BIT MAP(R1Q) 


Bite R12, R11 
IF Z TEEN 
DEC R2, #1 
ELSE 
LD R6, BLKS 
FI 
CP R2, HZERO 
IF EQ THEN 
LD R1, R10 
MULT RRO, #16 
ADD R1, Ril 
SUB R1, BLKS 
MULT RRO, #3LK SIZE 
ADD Ri, #LOCAL MEM BASE 
LD R0, #VALID 
LD R15, BLKS 
DO 
LD R12, LOCAL MEM BIT MAP(R12) 
DO 
SET R12, R11 
DEC R13, #1 
DEC R11, #1 
CP R13, #ZERO 
IF EQ TEEN 
LD LOCAL MEM BIT MAP(R12), R12 
RET 
FI 
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LD LOCAL MEM BIT MAP(R12), 


CP R11, #ZERO 
IF EQ THEN 
LD RII, #15 
DEC R10, #1 
EXIT 
FI 
OD 
OD 
FI 
INC R11, #1 
CP R11, #16 
IF EQ THEN 
LD R11, #ZERO 
EXIT 
FI 


OD 
INC R10, #1 


OD 
END ALLOC LOCAL MEMORY 


FREE LOCAL BIT MAP PROCEDURE 
l e ae ape e ade ne ae Se ate ae Se ofc ake fe e e e ae ala ole ode e ole e Sak e ode ole ae ic ake aie ae oie ak de k ! 
! PASSED PARAMETERS 
! RØ = BASE ADDR 


— 
— 
— 


! 
! 
l R1 BLKS ! 
! LOCAL VARIABLES ! 
! R10 - COUNTER FOR BIT RESET ! 
! R11 = BIT MAP INDEX ! 
! R12 - BIT MAP WORD l 
fe He ee ee ae ae abe ale le e dek e ape ae ade aK A BK AE ox oce ste aK ai IK e e a | 
ENTRY 
CLR RIP 
LD R11, R2 
SUB R11, #LOCAL MEM_BASE 
ev RRIG, FABLE SIZE*16 
DO 
LD R12, LOCAL MEM BIT MAP(R11) 
DO 
RES R12, R10 
DEC R1, #1 
CP R1, #ZBERO 
IF LT THEN 
LD LOCAL MEM BIT MAP(R11), 
RET 
FI 
INC Rig, +1 
CP Rig, 416 
IF EQ THEN 


"a 


E 


R1 


role 


LD LOCAL MEM BIT MAP(R11), R12 
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END 


LD R10, #ZERO 
EXIT 
FI 
OD 
INC Ril, #1 


OD 
FREE LOCAL BIT MAP 


FREE GLOBAL BIT MAP PROCEDURE 


! 
! 


[ Ga Ga ° E NE 


END 


Se e je a ae ake e ae e Safe e ek e ek ee e a a o a ok ae oe ae a ak a ak e | 
PASSED PARAMETERS ! 
RQ = BASE ADDR ! 

Ri = BLKS ! 
LOCAL VARIABLES ! 
! 

! 

! 

! 


R1@ = COUNTER FOR BIT RESET 

R11 = BIT MAP INDEX 

R12 = BIT MAP WORD 
EE e ste ste sie ope ste cie sie ote sic sie she zte ale aie ake ake ok ote aie 
ENTRY 
CLR RIZ 
LD R11, RØ 


SUB R11, #GLOBAL MEM BASE 
DIV RR1¢, #BLK SIZE*16 
DO 
LD R12, GLOBAL MEM BIT MAP(R11) 
DO 
RES R12, R10 
DEC R1, #1 
CP R1, #ZERO 
IF LT THEN 
LD GLOBAL MEM BIT MAP(R11), R12 
RET 
FI 
INC R10, #1 
CP R12, #16 
IF EQ THEN 
LD GLOBAL MEM BIT MAP(R11), R12 
LD R12, #ZERO 
EXIT 
FI 
OD 
INC R11, #1 
OD 
FREE GLOBAL BIT MAP 
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ALLOC GLOBAL MEMORY PROCEDURE 
Leide dee de IK FE E FEK SK K SK e e de e de BRR DR DAS DR DRE AR DC DAR DR AS DAR ES AR DR SR | 
! PASSED PARAMETER 
| RQ = BLXS OF MEMORY ! 
! RETURNED PARAMETERS ! 
! — RO - SUCCESS CODE ! 
| R1 = BASF_ADDR ! 
! LOCAL VARIABLES ! 
! RØ = BLKS ! 
| R12 = BIT_MAP INDEX ! 
! ! 
! ! 
! ! 
! ! 


R11 = COUNTER FOR BIT 
P12 = BIT_MAP WORD 
R13 = WORKING REGISTER 
WS SH SH de dee e RENE de e TIE de e e e Ve ee e dt de de e e EA A HC OK IS e de AS NE OK de 


LOCAL BLKS WORD 
IS_COMPACTED BYTE 
FILLERS ` SITE 
ENTRY 
LD BLKS, RQ 
LDB IS COMPACTED, #FALSE 
27, R10, #ZERO 
DO 
CP R1G, #(MAX_POSS_G_BLKS/16) 
IF EQ THEN 
CPB IS_COMPACTED, #FALSE 
IF EQ TEEN 
CALL COMPACT G 
LD R18, HZERO 
LDB IS COMPACTED, #TRUE 
ELSE 
LD RO, #GLOBAL MEM FULL 
RET 
FI 
RU 
LD Ril, #ZERO 
LD R12, GLOBAL MEM BIT MAP(R12) 
DO 
BIT R12, R11 
IF Z THEN 
DEC RØ, #1 
ELSE 
LD R2, BLKS 
FI 
CP RØ, #ZERO 
IF EQ THEN 
LD Ri, R12 
MULT RRO, #16 
ADD R1, R11 
SUB R1, BLKS 
MULT RRØ, #BLK_SIZE 


144 





ADD R1, 4GLOBAL MEM BASE 
LD RO, #VALID 
LD R13, BLKS 


DO 


E) R 2S 


DO 
SET 
DEC 
DEC 
CP 
IF 


FI 
CP 
IF 


FI 
OD 
OD 
FI 
INC Rili, #1 
CP Ril, #16 
IF EQ THEN 


GLOBAL MEM BIT MAP(R1G) 


R12, Ril 
Rilo, Ho 
Rii, #1 
R13, #ZERO 
EQ TEEN 
LD GLOBAL MEM BIT MAP(R10), R12 
RET 


R11, #ZERO 

EQ THEN 

LD GLOBAL MEM BIT MAP(R10), R12 
DINE DN e 

DEC R10, #1 

EXIT 


LD R11, #ZERO 


EXIT 
FI 


OD 
INC Rig, #1 


OD 
END ALLOC GLOBAL MEMORY 


READ PAGE PROCEDURE 


YAR AE OE AR AA RA A HE HE AE OE NE AE OE EAE AE BE HE AE EE OE HE AE OK A EE AEE ICE EE OK | 


! PASSED PARAMETERS 

| RG = BLK NO 

! Ri = BASE ADDR 

|! RETURNED PARAMETER 
| RG = SUCCESS CODE 
! LOCAL VARIABLES 
! 
! 


R18 = COUNTER FOR BLOCK MOVE 
Ril = SIMULATED DISK ADDRESS 


! 
! 
! 
! 
! 
! 
! 


PBR ACHE AE AE CHE 3s HEHE AE OE HE BE BE NC HE IE OE AS I AE SK IE OK SIE TE EE AE OE IR AS AK OE OE OE OE | 


ENTRY 
LDL RR10, #ELK SIZE 
MULT PR12, RE 


ADD Ril, #DISK_MEM_BASE 
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LD R1G, #MAX PAGE SIZE 
LDIR @R1i, CRÍ1, BI? 
LD RO, #VALID 

END READ PAGE 


WRITE PAGE PROCEDURE 
| >< EAE EK BE AE E E REK NE RE RE E FE RE RE IE RE RE FE AEE KOR KOK E E A ERER NE EO | 
! PASSED PARAMETERS 
RØ = BLK_NO ! 
R1 = FROM_BASE_ADDR ! 
RETURNED PARAMETR ! 
R@ = SUCCESS_CODE ! 
LOCAL VARIABLES ! 
R1@ = COUNTER FOR BLOCK MOVE ! 
R11 = SIMULATED DISK ADDRESS 
piexesedotoletotototetek KRK KKK KKK KKK KEK RKKK K KOKRA | 
ENTRY 
LDL RR10, #BLK SIZE 
MULT  RR12, R2 
ADD R11, 4DISK MEM BASE 
LD R10, #MAX PAGE SIZE 
LDIR @R11, CR1, RÍO 
LD RO, #VALID 
END WRITE PAGE 


ve u QÓ o u 9% 


READ_SEGMENT PROCEDURE 

| > EOK O E RE REE E NE IK E ER REIK E RRE > 3K 2⁄ >K e dee Ze der ee IKE EROR E ] 

! PASSED PARAMETERS ! 
! RO = PAGE TABLE LOC (BLK 4) ! 
! Ri = MEMORY_ADDR ! 
! RETURNED PARAMETER ! 
ier Ro = SUCCESS CODE ! 
! LOCAL VARIABLES ! 
! R2 - INDEX FOR PAGE TABLE ARRAY ! 
| R10 = COUNT FOR BLOCK MOVE ! 
J R11 = DISK_BLK_# CONV TO MEM ADDR ! 
J R15 = DISK ADDRESS ! 
J 28 2 A e aÃ SK S a AE S E OIE I OE OE IE ME Be Se aa e de e de a OR aK oa oe | 
ENTRY 
LDL RRi10, &BLK SIZE 
MULT RR12, R2 
ADD R11, 4DISK MEM BASE 
LD R2, #ZERO 
DO 
LD R19, 4MAX PAGE SIZE 

LD R13, R11(R2) 

MULT RR12, #BLK SIZE 

ADD R13, #DISK MEM BASE 

LDIR @R1, @R13, R10 

Come #1 
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CP R2, #MAX PAGE SIZE 
IF EQ THEN 
BE 
FI 
LD R9, R11(R2) 
CP RO, #ZERO 
IF EQ TEEN 
EXIT 
FI 
OD 
LD RO, #VALID 
END READ_SEGMENT 


WRITE SEGMENT PROCEDURE 
DRE DRE RE ape DR e DÃO A E A A e e ee FE IE AE AE IE FE DE SE IK FE IE IE OE AE NE OE OK OE KE OE Ef 
| PASSED PARAMETERS ! 
| RØ = PAGE_TABLE_LOC (BLK_#) ! 
! — R1 - MEMORY ADDR ! 
| RETURNED PARAMETER ! 
| RE = SUCCESS CODE ! 
! LOCAL VARIABLES ! 
! R12 = PAGE TABLE ARRAY INDEX ! 
! ! 
! 


R11 - DISK BLK NO CONV TO MEM ADDR 
! R13 = DISK ADDR ! 
PAR FE HE EAE AE BS AE EHS AE IE FS BR AE OE OE OE de >Z >£ >K AA IE AK NE CSE A ES AE | 
ENTRY 


LDL RR10, #BLK SIZE 
MULT RR12, R2 
ADD R11, #DISK_MEM_BASE 
LD R2, HZERO 
DO 
LD R1@, “MAX PAGE SIZE 
LD R13, R11(R2) 
MULT  RR12, #BER.SI7ZE 
ADD R13, #DISK_MEM BASE 
LDIR QR13, @R1, R12 
INC R2, #1 
CP R2, #MAX_PAGE_SIZE 
IF EQ TEEN 
EXIT 
FI 
LD R2, R11(R2) 
CP 20, #ZERO 
IF EQ TEEN 
EXIT 
FI 
OD 
LD R®, #VALID 
END WRITE_SEGMENT 
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READ DISK BIT MAP PROCEDURE 


p XE se 3k e ae exe e ox ee AE ASAE HS AE RE KK EK NE AK OK FK 


! RETURNED PARAMETERS 
R@ = SUCCESS CODE 
LOCAL VARIABLES 
R19 = 
R11 = COUNTER FOR BLK MOVE 
R13 = BIT MAP DISK ADDR 


@ cu cus PAE Ga 


PAE ASS EE AR LIA AA AT ARE A E SE E AE REK E RE DA ENE E AK E R E R | 


ENTRY 
LD Rid, #DISK_BIT MAP 
LD R13, #DISK BIT Map LOC 
CLR R12 
MULT RR12, 4BLK SIZE 
ADD R13, 4DISK MEM BASE 
LD R11, “(MAX POSS D BLKS/16) 
LDIR GQGR13, GR12, R11 
LD RG, #VALID 
END RFAD DISK BIT MAP 


WRITE DISK BIT MAP PROCEDURE 


DISK BIT MAP BUFF ADDR 


! 
! 
l 
] 
l 
! 
l 
! 


JR A efe a e ade kee e e fe e e MEE AE dee e e oe e EOK e de de Ze > ] 


! RETURNED PARAMETER 
! RQ = SUCCESS CODE 
LOCAL VARIABLES 


| 
l R1ð = DISK_BIT MAP_BUFF ADDR 
! R11 = COUNTER FOR BIT MAP 

! R13 = BIT MAP ADDRESS 


J BE A AS BE REE EE AE BE STE ASK SE AE OS SE EK OE OE AE OE ESIC SEK AE NE 


ENTRY 
LD R10, #DISX BIT MAP 
LD R13, 4DISK BIT MAP LOC 
CLR R12 
MULT RR12, #BLK SIZE 
ADD R13, #DISK MEM BASE 
LD R11, #(MAX_POSS_D_BLKS/16) 
LDIR CR1G, @R13, R11 
LD RG, #VALID 
END WRITE DISK BIT MAP 


SEARCH DISK BIT MAP PROCEDURE 


9p 995 cus OD GUS e 


ae a a a a OKO | 


YR AR BE a a A ae ae Oe ote xj ote ste cte e tote stood a a ae aK a a eae ae a ae aK KE | 


| PASSED PARAMETER 

! RO = START SRCE BLK £ 
| RETURNED PARAMETERS 
! RZ = SUCCESS_CODE 
! R1 - FREE BLK # 

! LOCAL VARIABLES 
1 

! 


R19 = BIT COUNTER 
R11 = BIT MAP INDEX 
R12 = BIT MAP WORD 


14€ 


es eum CS qa O—D 6b Cu QD Om 





END 


EI TOO J 


ENTRY 

CLR RIZ 

LD R11, R2 

DIV  RR19, #16 

R10 - REM, R11 = QUOT l 


DO 
LD R12, DISK_BIT_MAP (R11) 
DO 
BIT R12, R12 
IF Z THEN 
SET R12, R10 
LD DISK BIT MAP(R11), R12 
LD R1, R11 
MULT RRO, #16 
ADD R1, R10 
LD RO, #VALID 
RET 
FI 
INC R12, #1 
CP R12, #16 
IF EQ THEN 
LD R10, #ZERO 
EXIT 
FI 
OD 
INC R11, #1 
CP Ril, 4(MAX POSS D BLKS/16) 
IF EQ TBEN 
LD RE, #SEC_STOR_FULL 
RET 
FI 
OD 


LD RO, #VALID 
SEARCH DISK BIT MAP 


CLEAR DISK BIT MAP PROCEDURE 


! 


! 
! 


e Ga Gëf fa gan 


! 


BE RB TE O e e e HE AE BE AE AE AEE HE IE AE de ERA RE AL RCNE RE REA e de e Ze Ze > Y 
PASSED PARAMETER ! 
RO = ELK NO TO CLEAR 
LOCAL VARIABLES ! 
BIT COUNTER ! 
! 

! 

! 


R12 - 
R11 = BIT MAP INDEX 
R12 = BIT MAP WORD 
DE EIS DIR DK DIS DE DNS JE > 2 > DR DIR E AE JE DIR DNS DS DIS ENE OK OE I OE OE Be HE OK 2 3 RP 
ENTRY 
CLR R12 
LD R11, R2 


DIV RR142, #16 
R12 - REM, Ril = QUOT ! 
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LD R12, DISK_BIT_MAP (R11) 

RES R12, R10 

LD DISK BIT MAP(R11), R12 
END CLEAR DISK BIT MAP 


MEMORY MOVE PROCEDURE 
YA AE AE ARES E DE AERE e e A I OE DAR De A E NE E ALI REA AR IAN J 
! PASSED PARAMETERS ! 
! RØ - TO ADDR ! 
! R1 = FROM_ADDR ! 
! R2 = SIZE IN BYTES ! 
YAA E K AE FERE A EK FE AE FE de E NEIE IK de e KOE SERE SE NEK E REOR KOK E ] 
ENTRY 
CLR R12 
LD R13, R2 
RR R13, #1 
LD R12, R2 
LDIRB GRi2, @R1, R13 

END MEMORY MOVE 


GET UNIQ ID PROCEDURE 
a a e ae ge e ea ape e OE AK OIE KE OE a as OE aa EI AEE OE AK OK | 
! RETURNED PARAMETERS ! 
! R9 = SUCCESS CODE ! 
! R1 = UNIQUE ID ! 
! NOTE: WILL BE STORED ON SEC STOR ! 
YR AE EE AEE AS AK SE SR CR RE SIE HEE IE IE RS TIE IS AE DE AUOK AO SOR ACE SOCOM] 
LOCAL WORK_SPACE BLK ARRAY [MAX PAGE SIZE 

UNIQ ID WORD 
ENTRY 
LD RG,  &4SYSTEM DATA LOC 
LD Ri, “WORK SPACE BLK 
CALL READ PAGE 
CP RØ, #VALID 
IF NE THEN 
RET 

FI 
LD R10, #ZERO ! UNIQ ID INDEX ! 
LD R13, WORK SPACE BLE(R12) 
LD UNIQ ID, R13 
INC R13, #1 
LD WORK SPACE BLK(R12), R13 
LD R0, &SYSTEM DATA LOC 
LD Ri, 4WORK SPACE BLK 
CALL WRITE PAGE 
LD Ri, UNIQ ID 

END GET UNIQ ID 





MAIN_LINE PROCEDURE 
ENTRY 
CALL ALLOC LOCAL MEMORY 
CALL EBUG 

END MAIN LINE 

END M MGR 2 


ion 





APPENDIX C — SWAP IN PLZ/ASM CODE 


MEM MGR MODULE 


! gr 2 VERS. 1.0 E S LS NM 


CONSTANT 
FALSE := H 
TRUE := 1 
AVAILABLE : OQ. ! AST ENTRY AVAILABLE ! 
ACTIVE = 1 1! AST ENTRY ACTIVE ! 
ZERO = ő 
NULL := 20900 
NULL PAGE := Ø 
E BUG = XA90D 
MONITOR = ZO059A 

! SUCCESS CODES ! 

INVALID :— Y 
VALID = 1 
FOUND = 2 
NOT_FOUND = 3 
SWAPPED IN = 4 
SWAPPED OUT = 5 
SEG ACTIVATED EG 
SEG DEACTIVATED = 7 
SEG CREATED :— 8 
SEG DELETED ¿= 9 
LEAF SEG EXISTS = 10 
NO_LEAF EXISTS = 11 
G_AST_FULL = 12 
L AST FULL = 13 
IN LOCAL MEMORY := 14 
NOT_IN_LOCAL MEM := 15 
LOCAL MEMORY FULL:- 168 
GLOBAL MEM FULL = 17 
VIRTUAL CORE FULL:= 18 
DUPLICATE. ENTRY = 19 
NO CHILD. TO DEL = 29 
SEC STOR FULL = 21 
DISK_ERROR ¿= 22 
ALIAS DOES NOT EXIST :- 23 


! ATTRIBUTE MASKS ! 
READ_MASK 
WRITE MASK 


¥(2)11111112 
2(2)00009391 


j H 
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CHANGED_MASK 

IN_MEMORY_MASK 

CLEARED 
AUTHORIZED ACCESS 

READ 

WRITE 

EXECUTE 


!  G_ AST FLAG BITS FIELD 
WRITABLE MASK 
WRITTEN MASK 

| DESIGN PARAMETERS 
BLK SIZE 
NO OF PROCESSORS 
MAX DBR NO 
G AST LIMIT 
L AST LIMIT 
MAX ENTRY NO 
NO SEG DESC REG 
FST POSS FREE BLK: 


TYPE 
ADDRESS 
ALIAS HEADER 
SEG_DESC_REG 


ALIAS 


MMU 


G_AST_REC 


! ONLY ONE PROCESSOR 


HW We tu 


I wu < 


UH H H H H H H I 


1 


2(2)91090000 
x(2)09022100 
2 | CLEAR ATTR ! 
g 
1 
2(2)00001300 
ASES ! 
%(2)@@C2GL1B 
%(2) 82000192 
128 
1 
4 ]| EVEN NC. OF DBR as? 
16 1! MAX ENTRIES IN G AST |! 
16 ! MAX ENTRIES IN LAST! 
21 I! SIZE OF ALIAS TABLE ! 
e 1 NO. OF SEGMENT/PROCESS 1 
1 
WORD 
RECORD [ 
SEG PAGE TABLE LOC WORD 
PAR ALIAS TABLE LOC WORD ] 
RECORD [ 
BASE ADDR ADDRESS 
LIMIT BYTE 
ATTRIBUTE BYTE ] 
RECORD [ 
UNIQUE_ID WORD 
CLASS WORD 
SITAS WORD 
PAGE TABLE LOC WORD 
ALIAS TABLE LOC WORD ] 
RECORD [ 
SDR ARRAY [NO SEG DESC REG 
SEG DESC REGJ 
BLKS USED WORD 
MAX BLKS WORD] 
RECORD [ 
UNIQUE_1D1 WORD 
GLOBAL_ADDR ADDRESS 


l 


S 





GLOBAL 


ISSECTION 


PROCESSORS L ASTE NO WORD 
! WRITTEN BIT AND WRITABLE BIT ! 
FLAG BITS WORD 
G ASTE NO PAR WORD 
NO ACTIVE IN MEMORY WORD 
NO ACTIVE DEPENDENTS WORD 

PAGE TABLE LOCi WORD 


SIZE1 WORD 
ALIAS TABLE LOC1 WORD 
S EQUENCER WORD 
INSTANCE1 WORD 
INSTANCE2 WORD ] 
DEAST REC RECORD [ 


MEMORY_ADDR ADDRESS 
SEGMENT_NO_ACCESS_AUTH ARRAY 
[MAX_DBR_NO BYTE] ] 


HANDLE RECORD [ 
UNIQUE ID2 WORD 
E INDEX WORD ] 
G DATA |! 
G_AST ARRAY [G_AST_LIMIT G_AST_REC] 
G AST LOCK BYTE 


DISK BIT MAP LOCK BYTE 


SSECTION L DATA |! 


EXTERNAL 


MMU IMAGE ARRAY [MAX DBR NO MMU] 
RA ST ARRAT [LSAST LIMIT LAST REC] 
ALIAS TABLE RECORD [ HEADER ALIAS HEADER 


ALIAS ENTRY ARRAY 
[MAX ENTRY NO ALIAS] ] 
DISK BIT MAP BUFF ARRAY [6 BYTE) 
PAGE TARLE BUFFER ARRAY [BLEK SIZE BYTE] 


ALLOC LOCAL MEMORY PROCEDURE 


ENTRY 


END ALLOC LOCAL. MEMORY 


READ SEGMENT PROCEDURE 


ENTRY 


END READ_SEGMENT 
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FREE LOCAL BIT MAP PROCEDURE 
ENTRY 
END FREE LOCAL BIT MAP 


ALLOC GLOBAL MEMORY PROCEDURE 
ENTRY 
END ALLOC_GLOBAL_MEMORY 


MOVE TO GLOBAL PROCEDURE 
ENTRY 
END MOVE TO GLOBAL 


SIGNAL OTHER MEMORY MANAGERS PROCEDURE 


ENTRY 
END SIGNAL_OTHER MEMORY MANAGERS 


INTERNAL 
UPDATE MMU_ IMAGE PROCEDURE 


ge HERE a xe al ote de oc o de e sk e e e e A AK aK af a ae A e aj ok ok ls e e ook 
! PASSED PARAMETERS 


| Rg = DBR # 
R1 = SEGMENT # 
R2 = ADDR 
R3 = 
= LIMIT 


! 
! 
! R4 
! LOCAL VARIABLES 
Rig = WORKING REGISTER 
f R13 = WORKING REGISTER 
! TE ARE EN RAS ARANA e de de e ie e de de E RE AENA AE RARA RE eee oae xe 
ENTRY 
LD R12, #MMU_IMAGE 
LD R13, #SIZEOF MMU 
MULT RR12, RO 
ADD R10, R13 
LD R13, #SIZEOF SEG DESC REC 
MULT RR12, R1 
ADD P19, R13 
LD CRIS, R2 
INC R1G, #2 
LDB @R10, RL4 
INC R12, 41 
LDB RL4, GR1€ 
CPB RL3, #EXECUTE 
IF EQ THEN 

ANDB RL4, 4%(2)11110111 
ELSE 

ANDB RL4, 4%(2)11111119 


! 
! 
! 
! 
! 
ACCESS ! 
! 
! 
! 
! 
! 


F 1 
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ORB RL4, RL3 
LDB QR10, RL4 
RET 

END UPDATE MMU IMAGE 


UPDATE L AST ACCESS PROCEDURE 
Í >x eot ad a dj a a o adole ze sot tee oot ee ste e | 


! PASSED PARAMETERS 


R7 - WORKING REGISTER 
PE AEE EE DEAS RE AC HE de dek e E RAN EAS A et >⁄ >⁄ > > 
ENTRY 
LD R5, 4L AST 
LD 27, #SIZEOF L_AST_REC 
MULT RR6, R$ 
ADD R7, #2 
ADD R7, R2 
ADD R5, R? 
LDB RL3, @R5 
CPB RL1, #WRITE 
IF EQ TEEN 
ORB RL3, 4L(2) 10000000 
LDB @R5, RL3 
ELSE 
ANDB RLS, #%(2)@1111111 
LDB RS, RL3 


! RO = INDEX 
! Ri = ACCESS AUTE 
! R2 = DBR # 
| LOCAL VARIABLES 
|! R5 - WORKING REGISTER ! 
! ! 


FI 
RET 
END UPDATE L AST ACCESS 


CHECK LOCAL MEMCRY PROCEDURE 
Y A a s at og oet ox ote teneo oto ae a e ad eae eae eae a 1 


PASSED PARAMETERS 


e 


R1@ = ADDR OF MMU IMAGE.SDR([SEG#] 
R11 = BE OF L AST[R2] .SEG/ACC[I] 
! R12,13 = WORKING REGISTERS 
eee e dd o | 


ENTRY 


J 
! RO = INDEX ! 
! RETURNED PARAMETER 
RO = TEST 
|! LOCAL VARIABLES ! 
! R2 =I ! 
! R3 = SEG_NO 
! RHZ = ATTRIBUTES ! 
l ! 
! ! 

! 
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LD Dä, #ZERO 
DO 
CP R2, sMAX DBR NO 
IF EQ THEN 
LD RYO, 4NOT IN LOCAL MEM 
RET 
FI 
COEL AST 
LD R13, #SIZEOF L AST REC 
MULT RR12, RO 
ABM Rad, R13 
ADD R11, #2 1 SEGMENT NO OFFSET ! 
ADD R11, R2 
LDB RL3, @R11 
CLRB RE3 
ANDB RL3, %(2)01111111 
CPR RL3, #ZERO 
IF NE TEEN 
LD BIG, #MMU IMAGE 
LD R13, *SIZEOF MMU 
MULT RR12, R2 
ADD Rig, R13 
ADD R10, R3 
ADD RÍO, 43 ! ATTRIBUTES OFFSET ! 
LDB RE1, @R1¢ 
ANDB RH1, 4IN MEMORY MASK 
CPB RH1, #ZERO 
IF NE TEEN 
LD R2, 4IN LOCAL MEMORY 
RET 
FI 
FI 
INC R2, #1 
OD 


END CHECK LOCAL MEMORY 


CHECK MAX VIRTUAL CORE PROCEDURE 
! xe sk ole ie oe sje ote zi nde sje ole te sie ote ak ae oe HKK OK ake oa a a af Sl ad dee de dr de K ! 
! PASSED PARAMETERS ! 
| RZ = DBR_# 
R1 = BLKS ! 
! RETURNED PARAMETER 
RB = SUCCESS CODE ! 
! LOCAL VARIABLES 
! R10,R12 = WORKING REGISTERS ! 
eee See dede ee oe dee too SRR AK AEA ARIA 1 
ENTRY 
LD E19, #MMU_IMAGE 
LD R13, #SIZEOF MMU 
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MULT RR12, R9 
ADD R10, R13 
LD R13, #SIZEOF SEG DESC REC 
MULT RR12, 4NC SEG DESC REG 
ADD R12, R13 
LD R12, @R12 
ADD R12, Ri 
INC R19, #2 
CP R12, GR12 
IF GT TEEN 
SUB R12, R1 
LD RØ, &VIRTUAL CORE FULL 
ELSE 
LD RO, #VALID 
FI 
DEC R10, #2 
LD QR120, R12 
RET 
END CBECK MAX VIRTUAL CORE 


SWAP IN PROCEDURE 
E be a ae e e ote e te te ote si o ae e e Se e e a fe e e de pe k e e e e de je fe e e ae f 


I PASSED PARAMETERS 


! RQ = INDEX 
! Ri = DBR # ! 
| R2 = ACCESS ! 
! RETURNED PARAMETER ! 
! RZ = SUCCESS CODE 

! 


J ote oot oe oe tee se tede ea a ae ae ae ae a ae ake a a ak af ae at oe ak ae a a ae 


LOCAL INDEX WORD 
DBR_NO WORD 
ACCESS WORD 


G AST BASE ADDRESS 
ENTRY 
LD INDEX, RO 
LD DBR_NO, Ri 
LO ACCESS, R2 
LD R5, ap AST 
Dr R1S, #SIZEOF G AST REC 
MULT RR12, RO 
ADD R5, R13 
LD  G AST BASE, R5 
ADD R5, #16 ! SIZE OFFSET ! 
CLR R6 
LD R7, QR5 
DIV RR6, &3LK SIZE 
LD R6, R7? 
DEC R5, 412 ! L AST INDEX OFFSET ! 
LD R7, n5 
LD RO, Ri 
LD R1, R6 
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CALL CHECK MAX VIRTUAL CORE 
CP RO, &VIRTUAL CORE FULL 
IF EQ TEEN 
RET 
FI 
INC R5, #4 ! NO ACTIVE IN MEMORY CFFSET ! 
INC ops, ai 
LD Re, QRS 
CP ACCESS, #WRITE 
IF EQ THEN 
DEC R5, #4 ! OFFSET TO FLAG BITS ! 
LD R4, Q@R5 
OR R4, #WRITABLE MASK 
LD GRS, R4 
FI 
LD RO, R? 
CALL CHECK LOCAL MEMORY 
AND R4, #WRITABLE MASK 


CP R4, #9 
IF NE THEN 
CP R&S, #1 


IF GT TEEN 
CP Be, SIN LOCAL MEMORY 
IF NE THEN 
LD R2, R6 
CALL ALLOC LOCAL MEMORY 
CP RZ, #LOCAL MEMORY FULL 
IF EQ THEN 
RET 
FI 
LD R9, R1 
INC R5, #8 ! PAGE TABLE LOC OFFSET ! 
LD RØ, @RS 
CALL READ SEGMENT 
CP RO, #VALID 
IF NE THEN 
LD R2, R9 
ID R1, R6 
CALL FREE LOCAL BIT MAP 
RET 
FI 
LD R10, #L_AST 
LD R13, &SIZEOF L AST REC 
MULT  RR12, R? 
ADD R19, R13 !MEMORY ADDR OFFSET INTO L AST! 
LD GOR12, RQ 
ELSE 
LD R10, 4L AST 
LD R13, &SIZEOF L AST REC 
MULT RR12, R7 
ADD R10, R13 
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LD R9, CRI 


FI 
FI 
ELSE 
LD Re, RO 
LD R5, G AST BASE 
INC R5, 42 | GLOBAL ADDR OFFSET ! 


LD R12, @RS5 
CP R12, #NULL 
IF EQ THEN 
LD RØ, R6 
CALL  ALLOC GLOBAL MEMORY 
CP RG, #GLOBAL MEM FULL 
IF EQ THEN 
RET 
FI 
LD R9, R1 
CP R8, 4IN LOCAL MEMORY 
IF EQ THEN 
LD RO, R? 
INC R5, #14 ! SIZE OFFSET ! 
LD R2, @RS 
CALL MOVE TO GLOBAL 
CP RØ, #VALID 
IF NE THEN 


RET 
FI 
ELSE 
LD RZ, R1 


LD R1, INDEX 

CALL SIGNAL OTHER MEMORY MANAGERS 
CP RG, #VALID 

IF NE THEN 


RET 
FI 
FI 
ELSE 
LD R5 ,G AST BASE 
ADD R5, #2  ! GLOBAL ADDR OFFSET ! 
LD R9, QR5 


FI 

FI 

LD RO, DB5R NO 
LD Rig, 4L. AST 
LD R13, #SIZEOF L AST REC 
MULT RR12, R? 
ADD Rig, R13 
ADD R12, RØ 
INC R10, 42 
LDB RL1, GR1Q 
LD R2, R9 
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LD R3, ACCESS 
LD R4, R6 
CALL UPDATE MMU IMAGE 
LD RO, R? 
LD Ri, ACCESS 
LD R2, DBR NO 
CALL UPDATE L AST ACCESS 
LD RG, #SWAPPED IN 
END SWAP_IN 


MAIN LINE PROCEDURE 
ENTRY 
CALL SWAP IN 
CALL HBUG 

END MAIN LINE 

END MEM, MGR 


Jol 
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